Cowrie
馃敩 Digital Forensics 路 Python
Cowrie is a medium to high interaction SSH and Telnet honeypot designed to log brute force attacks, shell interactions, and file downloads. It emulates a full Unix system with a fake filesystem, allowing attackers to interact naturally while all commands, keystrokes, and uploaded files are recorded. Cowrie supports SFTP/SCP file upload capture, session replay in real-time or asynchronously, and forwards connection metadata to ELK, Splunk, or JSON files. It can proxy connections to real systems for high-interaction scenarios. Used to collect threat intelligence on attack tools, credentials, and TTPs being used against SSH infrastructure.
Installation
$ git clone https://github.com/cowrie/cowrie.git && cd cowrie && pip install -r requirements.txtUse Cases
- Capturing SSH brute force attack credentials and tools
- Logging attacker shell sessions for TTP analysis
- Collecting malware samples from automated attacks
- Generating threat intelligence from attack patterns
Tags
Details
- Category
- 馃敩 Digital Forensics
- Language
- Python
- Repository
- cowrie/cowrie
- Platforms
- 馃惂linux馃崕macos
Links
Used in 1 Workflow
Community Reviews
Alternatives & Comparisons
Velociraptor
GoEndpoint visibility and collection tool. Hunt for artifacts across thousands of endpoints simultaneously.
Compare Cowrie vs VelociraptorMore in Digital Forensics
Volatility 3
PythonAdvanced memory forensics framework. Extracts artifacts from RAM dumps - processes, network connections, registry.
Autopsy
JavaDigital forensics platform with GUI. Disk image analysis, timeline analysis, keyword search, hash filtering.
Ghidra
JavaNSA's reverse engineering framework. Disassembly, decompilation, graphing, and scripting for binary analysis.
Binwalk
PythonFirmware analysis tool. Searches binary images for embedded files, executables, and file systems.
YARA
CPattern matching swiss knife for malware researchers. Create rules to identify and classify malware samples.
Velociraptor
GoEndpoint visibility and collection tool. Hunt for artifacts across thousands of endpoints simultaneously.