Skip to content
Python Other
  1. Python 99.2%
  2. Other 0.8%
Branch: master
Clone or download


Type Name Latest commit message Commit time
Failed to load latest commit information.
.circleci Various bug fixes (#1261) Nov 5, 2019
.github add SUPPORT Jul 20, 2018
bin update> (#1281) Dec 13, 2019
docs Working ELK setup for 7.6.1 (#1316) Mar 27, 2020
etc put hpfeeds3 in default config file (#1322) Apr 1, 2020
honeyfs remove signature value for cpu speed (#1282) Dec 13, 2019
share Add option to configure Qemu machine (#1189) Aug 27, 2019
src Update hpfeeds3 plugin to use config named hpfeeds3 (#1304) Apr 1, 2020
var Add a pool of backends for the proxy (#1181) Aug 26, 2019
.gitattributes cowrie rename May 12, 2015
.gitignore ignore .eggs (#1293) Jan 21, 2020
.travis.yml allow 2.7 failures (#1286) Jan 3, 2020
CHANGELOG.rst Doclink (#990) Jan 20, 2019
CONTRIBUTING.rst Doclink (#990) Jan 20, 2019
INSTALL.rst Doclink (#990) Jan 20, 2019
LICENSE.rst Doclink (#990) Jan 20, 2019 Setup (#996) Jan 27, 2019
Makefile scripts to update and freeze main dependencies (#1139) May 29, 2019
README.rst Doclink (#990) Jan 20, 2019
requirements-dev.txt scripts to update and freeze main dependencies (#1139) May 29, 2019
requirements-output.txt Add misp output (resolves #1306) (#1317) Mar 27, 2020
requirements.txt dependency upgrade Wed Apr 1 09:08:33 +08 2020 (#1321) Apr 1, 2020 Setup (#996) Jan 27, 2019
tox.ini more py versions (#1206) Sep 12, 2019



travis circleci codecov

Welcome to the Cowrie GitHub repository

This is the official repository for the Cowrie SSH and Telnet Honeypot effort.

What is Cowrie

Cowrie is a medium to high interaction SSH and Telnet honeypot designed to log brute force attacks and the shell interaction performed by the attacker. In medium interaction mode (shell) it emulates a UNIX system in Python, in high interaction mode (proxy) it functions as an SSH and telnet proxy to observe attacker behavior to another system.

Cowrie is maintained by Michel Oosterhof.


The Documentation can be found here.


You can join the Cowrie community at the following Slack workspace.


  • Choose to run as an emulated shell (default):
    • Fake filesystem with the ability to add/remove files. A full fake filesystem resembling a Debian 5.0 installation is included
    • Possibility of adding fake file contents so the attacker can cat files such as /etc/passwd. Only minimal file contents are included
    • Cowrie saves files downloaded with wget/curl or uploaded with SFTP and scp for later inspection
  • Or proxy SSH and telnet to another system
    • Run as a pure telnet and ssh proxy with monitoring
    • Or let Cowrie manage a pool of Qemu emualted servers to provide the systems to login to

For both settings:

  • Session logs are stored in an UML Compatible format for easy replay with the bin/playlog utility.
  • SFTP and SCP support for file upload
  • Support for SSH exec commands
  • Logging of direct-tcp connection attempts (ssh proxying)
  • Forward SMTP connections to SMTP Honeypot (e.g. mailoney)
  • JSON logging for easy processing in log management solutions


Docker versions are available.


Software required:

  • Python 3.5+
  • python-virtualenv

For Python dependencies, see requirements.txt.

Files of interest:

  • etc/cowrie.cfg - Cowrie's configuration file. Default values can be found in etc/cowrie.cfg.dist.
  • share/cowrie/fs.pickle - fake filesystem
  • etc/userdb.txt - credentials to access the honeypot
  • honeyfs/ - file contents for the fake filesystem - feel free to copy a real system here or use bin/fsctl
  • honeyfs/etc/ - pre-login banner
  • honeyfs/etc/motd - post-login banner
  • var/log/cowrie/cowrie.json - transaction output in JSON format
  • var/log/cowrie/cowrie.log - log/debug output
  • var/lib/cowrie/tty/ - session logs, replayable with the bin/playlog utility.
  • var/lib/cowrie/downloads/ - files transferred from the attacker to the honeypot are stored here
  • share/cowrie/txtcmds/ - file contents for simple fake commands
  • bin/createfs - used to create the fake filesystem
  • bin/playlog - utility to replay session logs

Data Sharing

Cowrie will by default upload data on crashes and Python exceptions to This information is used to improve the honeypot and is not shared with third parties. It can be disabled by setting enabled=false in [output_crashreporter].


Many people have contributed to Cowrie over the years. Special thanks to:

  • Upi Tamminen (desaster) for all his work developing Kippo on which Cowrie was based
  • Dave Germiquet (davegermiquet) for TFTP support, unit tests, new process handling
  • Olivier Bilodeau (obilodeau) for Telnet support
  • Ivan Korolev (fe7ch) for many improvements over the years.
  • Florian Pelgrim (craneworks) for his work on code cleanup and Docker.
  • Guilherme Borges (sgtpepperpt) for SSH and telnet proxy (GSoC 2019)
  • And many many others.
You can’t perform that action at this time.