Cowrie
Documentation
Blog
Changelog
Newsletter
Get Started

Changelog

Every Cowrie release, with the fixes and features that went into it. Dependency updates are counted rather than listed.

Release notes by emailRSS feedReleases on GitHub

Cowrie 3.1.3

Fixes

  • require an execute bit to run a file by path #40668 by @micheloosterhof
  • handle scp -d with no target directory #40532 by @micheloosterhof
  • a failed redirection skips the command with status 1, as in bash #40676 by @micheloosterhof
  • rename symlink entries without moving their targets #40678 by @kunaldrafts25
  • key csirtg and slack on the event's protocol field, not a system key #40681 by @micheloosterhof

Maintenance

  • layer ssh/telnet below shell and stop reading config at import #40640 by @micheloosterhof

First contribution from @kunaldrafts25. Thank you.

Plus 5 dependency updates.

Cowrie 3.1.2

Fixes

  • publish through pika's Twisted adapter instead of BlockingConnection #40656 by @micheloosterhof
  • insert through the driver's Twisted mode instead of blocking run() #40657 by @micheloosterhof
  • write through txmongo instead of blocking pymongo calls #40658 by @micheloosterhof
  • send through txredisapi instead of blocking redis-py calls #40659 by @micheloosterhof
  • make bare sync succeed silently #40660 by @micheloosterhof
  • split unquoted expansions, and never redirect on quoted or expanded words #40661 by @micheloosterhof
  • report command failures through the exit status, as GNU tools do #40662 by @micheloosterhof
  • cancel a command's scheduled calls when the client disconnects #40666 by @micheloosterhof
  • single-line disconnect logging and a cap on the client identification line #40667 by @micheloosterhof

Maintenance

  • drive txredisapi's factory directly and move to txredisapi 1.6.0 #40665 by @micheloosterhof
  • test Python 3.15 and 3.15t as stable releases #40664 by @micheloosterhof

Plus 5 dependency updates.

Cowrie 3.1.1

Fixes

  • name ls file arguments the way they were typed #40650 by @micheloosterhof
  • apply symbolic and operator chmod modes #40649 by @micheloosterhof
  • end a session's process once, whatever ends it #40643 by @sudu787

Maintenance

First contribution from @sudu787. Thank you.

Cowrie 3.1.0

Changes

  • chmod command: ensure private filesystem #40632 by @Caleb-Wishart
  • Drop Python 3.10 support #40648 by @micheloosterhof

Fixes

  • send socketlog events on the reactor instead of blocking in write() #40619 by @arbelonson-source
  • make the shell pass a honeypot-detection recon script #40644 by @micheloosterhof
  • same 300s idle timeout default for LLM and shell sessions #40641 by @micheloosterhof
  • remove unused fs import from chmod #40639 by @micheloosterhof

First contribution from @arbelonson-source. Thank you.

Plus 11 dependency updates.

Cowrie 3.0.15

Changes

  • Fix Earley shell-parser blow-up (#40597): unambiguous grammar, real pipelines and redirections #40611 by @micheloosterhof

Fixes

  • accept an empty password in userdb.txt #40521 by @micheloosterhof
  • parse /etc/passwd by line in finger #40525 by @micheloosterhof
  • prevent AlreadyQuit on clean shutdown for sqlite, mysql, postgresql plugins #40592 by @I-am-Krish
  • report a malformed cut field list instead of crashing #40529 by @micheloosterhof
  • use explicit collection_id for VirusTotal collections #40580 by @jarihu
  • annotate the finger test's passwd helper so mypy passes #40613 by @micheloosterhof
  • store directory modes, not decimal or file modes, for created directories #40612 by @micheloosterhof
  • raise ENOENT from fs.rmdir when the directory does not exist #40614 by @micheloosterhof
  • make fs.islink look at the entry instead of its target #40615 by @micheloosterhof
  • report an empty cp/mv destination instead of indexing it #40534 by @micheloosterhof

Maintenance

  • drop the unused backend_pool ping helper #40616 by @micheloosterhof
  • name the commit in the package version instead of a stale release number #40618 by @micheloosterhof
  • add setuptools-scm to the dev extra #40620 by @micheloosterhof
  • name the commit in the package version instead of a stale release number #40622 by @micheloosterhof

Plus 5 dependency updates.

Cowrie 3.0.14

Fixes

  • keep exec command usable when it is not valid UTF-8 #40520 by @micheloosterhof
  • register cowrie.urlhaus.submitted event id #40584 by @jarihu
  • rmdir and touch process all arguments #40596 by @nkbeast
  • space-separate ps COMMAND arguments #40549 by @micheloosterhof
  • write the shell prompt as UTF-8 #40544 by @micheloosterhof
  • escape attacker text in telegram messages #40543 by @micheloosterhof
  • decode the line buffer leniently for tab completion #40537 by @micheloosterhof
  • handle unknown curl content length #40445 by @cyphercodes
  • guard tab-completion against a missing client window size #40434 by @Sanjays2402
  • publish and reset the prometheus source-IP windows #40542 by @micheloosterhof
  • tolerate more malformed LLM prompt templates #40552 by @micheloosterhof
  • accept grep -m max-count #40594 by @AzazelSensei
  • guard printf against a malformed escape #40535 by @micheloosterhof

First contribution from @nkbeast, @cyphercodes, @Sanjays2402, @AzazelSensei. Thank you.

Plus 9 dependency updates.

Cowrie 3.0.13

Features

  • add URLhaus output plugin #40568 by @jarihu

Fixes

  • release integrity, ssh_proxy parity and DNS-rebinding in outbound downloads #40510 by @micheloosterhof
  • sqlite output drops file uploads and session input #40511 by @micheloosterhof
  • close the upload descriptor before renaming the temp file #40553 by @micheloosterhof
  • decode ttylog data leniently when converting to asciinema #40548 by @micheloosterhof
  • print real UTC in dig's WHEN line #40530 by @micheloosterhof
  • fall back to the default width on a non-numeric COLUMNS #40536 by @micheloosterhof
  • read rethinkdblog event timestamps as UTC #40538 by @micheloosterhof
  • log the proxy backend address as a string #40550 by @micheloosterhof
  • encode base64 interactive input as UTF-8 #40528 by @micheloosterhof
  • reassemble proxied SFTP messages by their length prefix #40557 by @micheloosterhof
  • keep the ftpget download running through CTRL-C #40556 by @micheloosterhof
  • expand an empty $@ / $* to no words #40554 by @micheloosterhof
  • handle a bare trailing CR in telnet proxy auth #40551 by @micheloosterhof
  • apply createfs's -v and -p flags #40547 by @micheloosterhof
  • reject a non-numeric uid/gid in fsctl chown/chgrp #40546 by @micheloosterhof
  • release misp session tracking when the session closes #40541 by @micheloosterhof
  • report an invalid grep pattern instead of raising re.error #40533 by @micheloosterhof
  • escape CEF extension values #40527 by @micheloosterhof
  • report whole days and years from durationHuman #40526 by @micheloosterhof
  • release dshield session state when the session closes #40540 by @micheloosterhof
  • append to the jsonlog logfile instead of truncating it #40524 by @micheloosterhof
  • let virustotal submit URLs it has never seen before #40522 by @micheloosterhof
  • hold a single sqlite connection in the output pool #40523 by @micheloosterhof
  • report the real size of an SFTP upload #40555 by @micheloosterhof
  • never stop an output plugin that failed to start #40576 by @micheloosterhof
  • report IPv6 download targets as unreachable #40582 by @micheloosterhof
  • report a malformed URL port in curl and wget #40545 by @micheloosterhof
  • survive an empty -c argument and non-UTF-8 stdin in sh #40531 by @micheloosterhof
  • decode bytes IP in ssh_proxy connect_to_backend for clean logging #40518 by @abhi-0203
  • catch OSError and process all arguments #40583 by @I-am-Krish

Maintenance

  • satisfy mypy on four test modules #40578 by @micheloosterhof
  • pin the auth answer the telnet proxy password test depends on #40577 by @micheloosterhof
  • pin the container's uid #40579 by @micheloosterhof
  • keep event ids, emitters, consumers and docs in step #40575 by @micheloosterhof

First contribution from @jarihu, @abhi-0203, @I-am-Krish. Thank you.

Plus 11 dependency updates.

Cowrie 3.0.12

Fixes

  • cap the size of shell input fed to the parser #40441 by @micheloosterhof
  • strip pip, setuptools and wheel from the runtime venv #40446 by @micheloosterhof

Plus 6 dependency updates.

Cowrie 3.0.11

Changes

  • fingerprinting with CI #2791 by @micheloosterhof
  • share the honeyfs tree across sessions (copy-on-write) #40387 by @micheloosterhof
  • Wait for async commands (wget/curl) in command substitution #40425 by @micheloosterhof
  • Give each shell its own working directory #40428 by @micheloosterhof
  • Output plugin cleanups: remove crashreporter, fix slack client reuse and timestamp option #40426 by @micheloosterhof
  • Give each shell its own user identity #40429 by @micheloosterhof
  • Feed a pipeline stage that finishes asynchronously (wget URL | sh) #40431 by @micheloosterhof
  • Keep a command's stdio wiring on the command #40430 by @micheloosterhof

Features

  • read stdin in grep when no files are given #40371 by @micheloosterhof
  • support the HAProxy PROXY protocol #40372 by @micheloosterhof
  • add a nix flake #40433 by @micheloosterhof

Fixes

  • run long pipelines flat instead of recursing per stage #40373 by @micheloosterhof
  • handle GreyNoise request failures instead of erroring #40374 by @micheloosterhof
  • handle failed HTTP requests in output plugins #40375 by @micheloosterhof
  • flush buffered frontend packets in proxy mode #40376 by @micheloosterhof
  • survive terminalProtocol teardown mid-dataReceived #40268 by @micheloosterhof
  • ignore CHANNEL_WINDOW_ADJUST for already-closed channels #40378 by @micheloosterhof
  • treat a bare = as a command name, not an assignment #40379 by @micheloosterhof
  • abort downloads that exceed download_limit_size #40380 by @micheloosterhof
  • treat an empty symlink target as a broken link #40398 by @micheloosterhof
  • re-authenticate returning attackers in AuthRandom #40400 by @micheloosterhof
  • use posixpath for emulated-filesystem paths (Windows support) #40403 by @micheloosterhof
  • make the outbound rate limiter case-insensitive per host #40406 by @micheloosterhof
  • apply rate limit, size limit and outbound bind to ftpget #40407 by @micheloosterhof
  • move wget/curl/nc rate-limit options to [shell] and document them #40408 by @micheloosterhof
  • harden DB output plugins against error-handler crashes and NULL-string rows #40409 by @micheloosterhof
  • harden scp upload parsing against crashes and file floods #40410 by @micheloosterhof
  • don't crash on attacker-controlled bytes that aren't valid UTF-8 #40412 by @micheloosterhof
  • harden telnet subsystem against malformed client input #40411 by @micheloosterhof
  • harden the LLM backend against attacker input and runaway API use #40413 by @micheloosterhof
  • refuse an out-of-sequence keyboard-interactive INFO_RESPONSE #40414 by @micheloosterhof
  • cache reversedns results instead of spent Deferreds #40417 by @micheloosterhof
  • reconcile event id consumers with the ids Cowrie emits #40420 by @micheloosterhof
  • ignore CHANNEL_REQUEST for an unknown or closed channel #40419 by @micheloosterhof
  • tftp IPv6 crash, missing rate limiter, unenforced size limit, and resolution TOCTOU (#40394) #40422 by @micheloosterhof
  • name temp backing files with a prefix and uuid #40421 by @micheloosterhof
  • nc no longer blocks the reactor with stdlib sockets #40424 by @micheloosterhof
  • declare ILogObserver on the log observer factory #40427 by @micheloosterhof

Maintenance

  • pin all GitHub Actions to full commit SHAs #40363 by @micheloosterhof
  • add security policy (SECURITY.md) #40366 by @micheloosterhof
  • add changelog and issues project URLs #40367 by @micheloosterhof
  • reproducible build metadata and runtime hardening #40364 by @micheloosterhof
  • add pip-audit dependency vulnerability scanning #40365 by @micheloosterhof
  • dispatch docker and pypi publish workflows from weekly release #40377 by @micheloosterhof
  • make pyright usable, then fix everything it finds #40392 by @micheloosterhof
  • plain-language overhaul of the documentation tree #40418 by @micheloosterhof
  • prune vacuous, tautological, and duplicate tests #40432 by @micheloosterhof

Plus 10 dependency updates.

Cowrie 3.0.10

Features

  • kafka output based on aiokafka #40355 by @micheloosterhof
  • kafka output based on aiokafka #40326 by @rwakulszowa

Fixes

  • accept bare-CR line endings at the telnet login prompt (PuTTY) #40344 by @micheloosterhof
  • stop logging a traceback for malformed telnet IAC traffic #40345 by @micheloosterhof

First contribution from @rwakulszowa. Thank you.

Cowrie 3.0.9

Fixes

  • prevent session hang from IPv4-embedded IPv6 download URLs #40336 by @micheloosterhof
  • handle TCP connect timeout in curl and wget downloads #40337 by @micheloosterhof
  • derive OptionParsingError from Exception #40339 by @micheloosterhof
  • resolve tftp target hostname before UDP I/O #40340 by @micheloosterhof
  • drop OpenSSH host-key rotation requests in ssh proxy #40341 by @micheloosterhof
  • run a shell reading channel stdin when bash is the exec command #40342 by @micheloosterhof
  • bind outbound downloads to out_addr so they don't leak the server IP #40343 by @micheloosterhof

Maintenance

  • bump mypy to 2.3.0 and mypy-zope to 1.0.16 #40338 by @micheloosterhof

Plus 3 dependency updates.

Cowrie 3.0.8

Fixes

  • block IPv4-mapped and embedded-IPv4 IPv6 addresses in outbound filter #40329 by @micheloosterhof
  • block non-globally-routable outbound targets #40330 by @micheloosterhof

Cowrie 3.0.7

Changes

  • fix broken postgresql output #40313 by @dongdigua

Features

  • support the exec shell builtin #40308 by @micheloosterhof

Fixes

  • guard against None transport in sendPacket (#40324) #40325 by @fazalpsinfo-cmyk

First contribution from @fazalpsinfo-cmyk, @dongdigua. Thank you.

Plus 9 dependency updates.

Cowrie 3.0.6

Changes

  • reduce duplicate-download logging to one congruent message #40270 by @micheloosterhof
  • Session-scoped event pipeline: attribute events at emission, delete the log-observer path #40286 by @micheloosterhof

Features

  • config-driven log levels and per-class twisted.logger diagnostics #40312 by @micheloosterhof

Fixes

  • clean up unhandled wget error logging #40259 by @micheloosterhof
  • release file handle before renaming captured logs on Windows #40260 by @micheloosterhof
  • reset exec idle timeout on inbound stdin #40261 by @micheloosterhof
  • capture exec-channel stdin in cat redirect output #40262 by @micheloosterhof
  • report bundled-resource directory reads as FileNotFoundError #40263 by @micheloosterhof
  • handle empty path in resolve_path and file tests #40266 by @micheloosterhof
  • avoid ZeroDivisionError in wget speed calculation #40267 by @micheloosterhof
  • drop and log malformed SSH packets instead of crashing #40264 by @micheloosterhof
  • annotate treq header dicts to match the expected type #40272 by @micheloosterhof
  • run async commands in scripts sequentially without cmdstack corruption #40273 by @micheloosterhof
  • keep the session alive when exit runs inside a command substitution #40276 by @micheloosterhof
  • make late tftp download callbacks safe after session close #40280 by @micheloosterhof
  • parse input queued while a command is running #40299 by @micheloosterhof
  • log telnet process end as an exit status, not a Failure repr #40300 by @micheloosterhof
  • write each jsonlog event in a single call to survive rotation #40301 by @micheloosterhof
  • survive a late second exit() from pending download callbacks #40274 by @micheloosterhof
  • queue mid-command input on the innermost shell #40303 by @micheloosterhof
  • ignore channel EOF/CLOSE for already-closed SSH channels #40305 by @micheloosterhof
  • resolve CNAME chains and AAAA records in communication_allowed #40307 by @micheloosterhof

Maintenance

  • upgrade treq to 26.7.0 and drop requests/urllib3 #40271 by @micheloosterhof
  • register the fake async command without shadowing the ClassVar #40302 by @micheloosterhof
  • build bcrypt from git on free-threaded 3.15 #40304 by @micheloosterhof
  • capture late download events through the session EventLog #40306 by @micheloosterhof

Plus 15 dependency updates.

Cowrie 3.0.5

Changes

  • Real command exit status: $?, && / ||, and exec exit-status #40222 by @micheloosterhof
  • Translate emulated-filesystem errors at the SFTP boundary #40223 by @micheloosterhof
  • Report "Bad file descriptor" for an out-of-range redirect fd #40224 by @micheloosterhof
  • Register backing files for command-less output redirections #40226 by @micheloosterhof
  • Discard data that arrives after the terminal protocol is torn down #40227 by @micheloosterhof
  • Remove empty download artifacts on early wget/curl exits #40228 by @micheloosterhof
  • Report "Is a directory" instead of disconnecting on a directory command #40229 by @micheloosterhof
  • Reject binary files passed to sh/bash instead of parsing their bytes #40230 by @micheloosterhof
  • Log a failed DNS lookup at info level, not as an "Unhandled Error" #40231 by @micheloosterhof
  • Comment on and collect VirusTotal uploads by file hash, not analysis id #40234 by @micheloosterhof
  • Log each telnet option negotiation once per connection #40232 by @micheloosterhof
  • Added OCSF output #40233 by @JustSamAgain
  • Reuse an existing VirusTotal collection instead of re-creating it #40235 by @micheloosterhof

Features

  • replace the shlex shell parser with a Lark grammar #40219 by @micheloosterhof
  • add su command for switching user identity #40212 by @micheloosterhof
  • emulate shell flow control (for/if/while/until/case, functions, test/[) #40243 by @micheloosterhof

Fixes

  • disconnect cleanly on duplicate KEXINIT during key exchange #40206 by @micheloosterhof
  • check init before stop/force-stop/status #40236 by @micheloosterhof
  • handle invalid IAC byte in telnet without crashing (#40218) #40239 by @micheloosterhof
  • escape non-printable bytes in logged untrusted input #40240 by @micheloosterhof
  • correct ConnectingDone typo in wget error handling #40242 by @micheloosterhof
  • tftp downloads produce empty hashes and crash the VirusTotal output #40241 by @micheloosterhof
  • type telnet transport protocol mock in test #40245 by @micheloosterhof

Maintenance

  • publish the docker image only from release tags #40220 by @micheloosterhof

First contribution from @JustSamAgain. Thank you.

Plus 5 dependency updates.

Cowrie 3.0.4

Changes

  • recording "last command" for DShield #40162 by @jullrich
  • Update requirements-output.txt #40155 by @TrueDru
  • Fix/cmdstack leak no input #40170 by @micheloosterhof
  • Address pyright diagnostics: real bugs and noise reduction #40190 by @micheloosterhof
  • Report directory and missing path-like commands with shell-accurate errors #40194 by @micheloosterhof

Features

  • implement chpasswd command simulation with logging #40144 by @Sanchitha408

Fixes

  • send bare LF on PTY-less exec channels #40169 by @micheloosterhof
  • persist shell variables and separate exported environment #40171 by @micheloosterhof
  • count nested subshells in command substitution #40173 by @micheloosterhof
  • emit session and TTY-log duration as integer milliseconds (duration_ms) #40175 by @micheloosterhof
  • look up MISP malware samples by MD5 #40191 by @micheloosterhof
  • save scp uploads as file content, not SCP wire framing #40196 by @micheloosterhof
  • stop telnet negotiation retries from crashing connection teardown #40198 by @micheloosterhof
  • deliver SSH session connectionLost exactly once on teardown #40200 by @micheloosterhof
  • skip stdin-log save when exec session sent no input #40199 by @micheloosterhof
  • honour output redirection for busybox-dispatched applets #40202 by @micheloosterhof
  • ignore NUL bytes in interactive shell instead of logging a warning #40201 by @micheloosterhof
  • restore initial NAWS negotiation for telnet connections #40204 by @micheloosterhof
  • resolve mypy errors in MISP output plugin and tests #40203 by @micheloosterhof
  • remove orphaned temp file on failed wget/curl download #40205 by @micheloosterhof

First contribution from @TrueDru, @Sanchitha408. Thank you.

Plus 7 dependency updates.

Cowrie 3.0.0

Changes

  • Port dshield to treq, adopt modern submitapi, fix enrichment race #40119 by @micheloosterhof

Features

  • pip-installable cowrie state directory model #40138 by @micheloosterhof

Maintenance

  • fix mypy on Python 3.15 stubs; drop unused tftpy dependency #40141 by @micheloosterhof

Plus 4 dependency updates.

Cowrie 2.9.20

Features

  • embed file contents into bundled fs.pickle #40137 by @micheloosterhof

Fixes

  • read issue.net banner as UTF-8 with replacement #40136 by @micheloosterhof

Maintenance

  • delay non-security updates with 7-day cooldown #40129 by @micheloosterhof

Plus 9 dependency updates.

Cowrie 2.9.19

Changes

  • Bump default emulated OS fingerprint to Debian 12 / kernel 6.1 #40090 by @Bierchermuesli
  • Realign tests for Debian 12 fs.pickle; promote dump tool to cowrie.scripts.dumpfs #40101 by @micheloosterhof
  • Clean up artifacts that leaked through #40101 squash-merge #40102 by @micheloosterhof
  • license: add SPDX headers and REUSE compliance #2935 by @micheloosterhof
  • Bump Twisted to 26.4.0 and adopt its stricter typing #40117 by @micheloosterhof
  • Port malshare and cuckoo output plugins to treq #40118 by @micheloosterhof

Maintenance

  • type test_tftp.py and test_ftpget.py properly for mypy #40111 by @micheloosterhof

Plus 13 dependency updates.

Cowrie 2.9.18

Changes

  • LLM Anthropic support + Configurable context prompt #38602 by @Bierchermuesli

Plus 6 dependency updates.

Cowrie 2.9.16

Changes

  • Proxy support for llm backend #34061 by @Bierchermuesli
  • ifconfig & netstate IPv6 aware #2912 by @Bierchermuesli

Fixes

  • resolve mypy type errors in LLM client #40081 by @micheloosterhof

First contribution from @Bierchermuesli. Thank you.

Plus 6 dependency updates.

Cowrie 2.9.15

Changes

  • Fix chattr: remove Command_nop as it overshadow the command #2931 by @statzitz

First contribution from @statzitz. Thank you.

Plus 2 dependency updates.

Cowrie 2.9.12

Changes

  • Devops work #2905 by @micheloosterhof
  • Execute shell scripts #2908 by @micheloosterhof

Maintenance

  • upgrade to Debian 13 (trixie) / Python 3.13 #2906 by @micheloosterhof
  • fix duplicate tox runs on Dependabot PRs #2907 by @micheloosterhof

Plus 1 dependency update.

Cowrie 2.9.11

Changes

  • Modernize Python patterns for 3.10+ across codebase #2903 by @micheloosterhof

Plus 5 dependency updates.

Cowrie 2.9.10

Changes

  • Add cut command for shell mode #2895 by @micheloosterhof

Plus 2 dependency updates.

Cowrie 2.9.9

Changes

  • Add CVE-2026-24061 vulnerability emulation for telnet #2891 by @micheloosterhof

Fixes

  • prevent recursion when onResult is None #2892 by @micheloosterhof
  • backend_pool throwing NAT errors in remote mode when client_protocol is not initialized/closed #2881 by @NathanAdhitya

Maintenance

  • enable PyO3 ABI3 forward compatibility for Python 3.15 #2884 by @micheloosterhof

Plus 5 dependency updates.

Cowrie 2.9.8

Changes

  • Add CVE-2026-24061 exploit detection for telnet NEW-ENVIRON option #2883 by @micheloosterhof

Fixes

  • wget saves files to cwd instead of root #2875 by @micheloosterhof
  • handle PackageNotFoundError in conf.py and fix RST title l… #2882 by @micheloosterhof

Plus 5 dependency updates.

Cowrie 2.9.7

Changes

  • 3.11->3.12 for readthedocs #2873 by @micheloosterhof

Fixes

  • backend_pool throwing NAT errors in remote mode when client_protocol is not intialized yet #2864 by @NathanAdhitya

Maintenance

  • add local SSH testing instructions #2862 by @Mutsawashe2006

First contribution from @NathanAdhitya, @Mutsawashe2006. Thank you.

Plus 7 dependency updates.

Cowrie 2.9.5

Fixes

  • pin cosign to v2.4.1 for Docker Hub compatibility #2855 by @micheloosterhof

Cowrie 2.9.4

Fixes

  • SSRF protection bypass in ftpget, tftp, and nc commands #2852 by @micheloosterhof

Cowrie 2.9.3

Changes

  • Pr 2827 improve backend logging #2843 by @micheloosterhof

Fixes

  • improve FD redirection parsing and refactor shell modules #2849 by @micheloosterhof
  • playlog now shows output for exec sessions #2850 by @micheloosterhof

Plus 3 dependency updates.

Cowrie 2.9.2

Changes

  • Refactor sleep command with improved option handling #2822 by @filippolauria

Fixes

  • resolve variable/method shadowing bugs #2840 by @micheloosterhof
  • chmod --help and --version were broken #2841 by @micheloosterhof

Maintenance

  • use native ARM64 runner for faster Docker builds #2842 by @micheloosterhof
  • add SSH proxy smoke tests #2844 by @micheloosterhof

Plus 3 dependency updates.

Cowrie 2.9.1

Changes

  • swap cosign arguments and commands #2813 by @micheloosterhof
  • self.write->self.errorWrite #2812 by @micheloosterhof
  • Improve nc command realism and add abuse protection #2815 by @filippolauria
  • Fix Proxy mode failing to start #2825 by @Weijo
  • Add weekly automated release workflow #2836 by @micheloosterhof
  • Fix error on fs tab completion for non-existing dirs #2835 by @Caleb-Wishart

First contribution from @Weijo, @Caleb-Wishart. Thank you.

Plus 8 dependency updates.

Cowrie 2.9.0

Changes

  • Various fixes #2765 by @micheloosterhof
  • ga4 #2766 by @micheloosterhof
  • Awk #2767 by @micheloosterhof
  • Ja4 fingerprinting #2773 by @micheloosterhof
  • update docs for nft and other tweaks #2774 by @micheloosterhof
  • Dock #2768 by @micheloosterhof
  • Support FTP URLs in wget command #2787 by @CoreZen
  • Update ifconfig to add more realistic packet / byte counts #2804 by @e991f665b7e62df5a54fdef19053a4e75117b89
  • Add rate limiting to prevent DDoS abuse and improve wget command #2800 by @filippolauria
  • Update OUTPUT.rst with events currently not present #2429 by @marcopedrinazzi
  • LLM backend for cowrie (openAI for now) #2809 by @micheloosterhof
  • Add Python 3.15 testing (allowed to fail) #2810 by @micheloosterhof
  • bump version #2811 by @micheloosterhof

Features

  • improve Discord webhook plugin with queue-based retry and rate-limit handling #2798 by @CoreZen

Maintenance

  • fix typos in some files #2796 by @Edge-Seven

First contribution from @Edge-Seven, @CoreZen, @e991f665b7e62df5a54fdef19053a4e75117b89, @filippolauria, @marcopedrinazzi. Thank you.

Cowrie 2.8.1

Changes

  • Deprecate python 3.9 #2747 by @micheloosterhof
  • Python 3.14 support #2760 by @micheloosterhof
  • VirusTotal v3 support #2755 by @micheloosterhof
  • Ftp async rewrite #2758 by @micheloosterhof
  • Tftp async rewrite #2759 by @micheloosterhof
  • add protocol in event log #2762 by @micheloosterhof
  • UUID #2763 by @micheloosterhof

Cowrie 2.8.0

Changes

  • Pypi #2744 by @micheloosterhof
  • better docker tags #2726 by @micheloosterhof
  • partially functional chmod #2732 by @micheloosterhof
  • packaging updates #2733 by @micheloosterhof
  • Update requirements handling and documentation #2734 by @micheloosterhof
  • Run without full directory structure (pip install) #2739 by @micheloosterhof

Cowrie 2.7.0

Breaking changes

Changes

  • Install Cowrie into your virtual environment with pip install -e .
  • bin/ directory removed: Scripts asciinema, createfs, fsctl, and playlog are no longer called from the bin/ directory.
  • Python 3.9 no longer supported: Minimum Python version is now 3.10.
  • SQL schema update required: If using MySQL/SQLite databases, run the migration script docs/sql/update16.sql to extend IP address fields for IPv6 support (VARCHAR length increased to 61 characters).
  • SSH-DSS key support removed: The deprecated ssh-dss algorithm is no longer supported for improved security. Remove ssh-dss configuration if you use it.
  • New Output Plugins:
  • PostgreSQL output plugin with automatic reconnection support
  • Prometheus metrics output plugin for monitoring and alerting
  • New Shell Commands:
  • find command with basic options for file searching
  • dig command for DNS lookups
  • git command for version control simulation
  • curl command now supports HEAD requests with -I option
  • Enhanced Security:
  • Network blocking for outbound connections from wget/curl/nc to reserved IP ranges
  • Null byte password protection to prevent authentication bypasses
  • Updated SSH algorithms and key management for better security posture
  • Proxy Mode Improvements:
  • SFTP file transfers now logged and captured in proxy mode
  • Better SSH factory handling for improved stability
  • New configuration options available for:
  • PostgreSQL output plugin settings
  • Prometheus metrics endpoint configuration
  • Network blocking controls for command simulation
  • Docker:
  • Improved local build support
  • Docker:
  • Improved local build support
  • Container signing with Cosign for supply chain security
  • Updated base images and metadata
  • Build System:
  • Migrated to setuptools-scm for automatic version management
  • PyPI package publishing now automated as trial for future development
  • Dependencies:
  • Twisted updated to 25.5.0
  • Elasticsearch client updated to 9.x
  • Various security updates across all dependencies
  • Enhanced MISP output plugin with overcuriosity protection and better threat intelligence integration
  • Simplified Slack output formatting for better readability
  • Better shell command substitution and subshell execution
  • Improved error handling in wget with explicit timeouts
  • ECS-compliant Logstash configuration template
  • Enhanced history handling in shell sessions
  • Added Python 3.14 development version support
  • Added PyPy 3.11 support
  • Improved test coverage and CI/CD pipelines

Cowrie 2.6.1

Changes

  • Devops #1811 by @micheloosterhof
  • Versionstringfix #1817 by @micheloosterhof
  • fix macs typo in cowrie.cfg.dist #1820 by @paseaf
  • Support for additional commands #1830 by @Masood-M
  • Correct description of the authentication_timeout setting in the conf… #1833 by @onlyvae
  • [Snyk] Security upgrade requests from 2.28.1 to 2.31.0 #1838 by @micheloosterhof
  • Reqs #1841 by @micheloosterhof
  • docker update #1842 by @micheloosterhof
  • platforms #1843 by @micheloosterhof
  • Dock3 #1844 by @micheloosterhof
  • updated #1845 by @micheloosterhof
  • don't use build/push together #1846 by @micheloosterhof
  • fix sftp ls #1853 by @micheloosterhof
  • pur->dependabot #1854 by @micheloosterhof
  • pyyaml->6.0.1 #1860 by @micheloosterhof
  • Mypy aug #1872 by @micheloosterhof
  • datadog: allow configuration of hostname #1866 by @galenguyer
  • fix docs #1886 by @micheloosterhof
  • rtd->py3.10 #1894 by @micheloosterhof
  • 3.12 allowed failures #1879 by @micheloosterhof
  • new format #1896 by @micheloosterhof
  • 23.8 #1907 by @micheloosterhof
  • Classvar new ruff version #1912 by @micheloosterhof
  • don't give exception if file download has failed #1913 by @micheloosterhof
  • scripts can now be run, and pip install -e works #1927 by @micheloosterhof
  • py 3.12 and pypy 3.10 #1952 by @micheloosterhof
  • pyupgrade38plus #1953 by @micheloosterhof
  • only run docker login in main repo #1955 by @micheloosterhof
  • different syntax for run because there's no shell #1962 by @micheloosterhof
  • 17oct #1968 by @micheloosterhof
  • update hpfeeds version #1979 by @D1sD3s
  • Oracle cloud custom logs plugin #1997 by @mamorett
  • fix regex to do explit dot #2008 by @micheloosterhof
  • remove duplicate code #2010 by @micheloosterhof
  • Patched fsctl as noted in PR #2009 #2011 by @halcyondream
  • Updated fsctl.py #2013 by @halcyondream
  • docker image updates through dependabit #2040 by @micheloosterhof
  • Removed DAEMONIZE steps. #1983 by @adam-qomodo
  • load cowrie path #2061 by @micheloosterhof
  • add suggestion from issue #1650 #2062 by @micheloosterhof
  • update reqs. #2077 by @micheloosterhof
  • [Snyk] Security upgrade cryptography from 42.0.1 to 42.0.2 #2082 by @micheloosterhof
  • ruff 0.2.1 #2090 by @micheloosterhof
  • Pyright #2091 by @micheloosterhof
  • remove custom ssl context factories #2135 by @micheloosterhof
  • new way to disable https checks #2136 by @micheloosterhof
  • Fix formatting in README.rst #2146 by @progalgo
  • Fix formatting in README.rst #2150 by @progalgo
  • [Snyk] Security upgrade cryptography from 42.0.5 to 42.0.6 #2165 by @micheloosterhof
  • formatting #2168 by @micheloosterhof
  • remove python 3.8 #2170 by @micheloosterhof
  • small shell fixes #2199 by @micheloosterhof
  • [Snyk] Security upgrade cryptography from 42.0.6 to 42.0.8 #2206 by @micheloosterhof
  • proxy fixes and improvements #2204 by @micheloosterhof
  • #1756 / added-support-for-h-flag-in-ls-comand #2217 by @RitvikDayal
  • display full path as specified for individual files #2218 by @micheloosterhof
  • revert - #2217 #2219 by @RitvikDayal
  • #1756 / added-support-for-h-flag-in-ls-comand #2220 by @RitvikDayal
  • ruff -> ruff check #2227 by @micheloosterhof
  • check if user is still connected. #2229 by @micheloosterhof
  • fix #2257 #2280 by @micheloosterhof
  • keep running commands on exec mode after first one fails. #2281 by @micheloosterhof
  • remove threatjammer. domain is gone. #2282 by @micheloosterhof
  • remove threatjammer from index #2283 by @micheloosterhof
  • fix #2291 #2302 by @micheloosterhof
  • proper Guest dataclass usage #2304 by @mjovanovic9999
  • Added support for remote syslog logging #2312 by @mjovanovic9999
  • update head to take -c. update quotes for remotesyslog #2318 by @micheloosterhof
  • treq -> 24.9.0 #2320 by @micheloosterhof
  • 3.13-dev #2321 by @micheloosterhof
  • black formatting #2328 by @micheloosterhof
  • Update locaksyslog.py #2325 by @cskinner74
  • add lspci #2329 by @micheloosterhof
  • Debian package updates #2330 by @micheloosterhof
  • Reduce dependencies #2335 by @micheloosterhof
  • Deps3 #2336 by @micheloosterhof
  • 21oct #2354 by @micheloosterhof
  • User #2356 by @micheloosterhof
  • Updated Graylog docs to also describe the pipeline feature #2355 by @gbyx3
  • Explicit deps #2358 by @micheloosterhof
  • Twisted2410 #2360 by @micheloosterhof
  • Disable oci python dependency #2367 by @micheloosterhof
  • Urllib #2378 by @micheloosterhof
  • Increq #2379 by @micheloosterhof
  • Defaults #2192 by @micheloosterhof
  • Devops #2380 by @micheloosterhof
  • Datadir #2381 by @micheloosterhof
  • file system fixes #2389 by @micheloosterhof
  • add option to login with any public key #2391 by @micheloosterhof
  • update issue templates #2392 by @micheloosterhof
  • fix for crashing ping command #2393 by @micheloosterhof
  • print which config files are used #2395 by @micheloosterhof
  • rmq #2396 by @micheloosterhof
  • pool reqs #1970 by @micheloosterhof
  • 22nov #2398 by @micheloosterhof
  • flags for ps to work on busybox. #2399 by @micheloosterhof
  • remove blowfish #2406 by @micheloosterhof
  • Ruff8 #2407 by @micheloosterhof
  • fix crash with 0 arguments #2408 by @micheloosterhof

Maintenance

  • debian bullseye to bookworm #1940 by @micheloosterhof

First contribution from @paseaf, @Masood-M, @onlyvae, @galenguyer, @D1sD3s, @mamorett, @halcyondream, @adam-qomodo, @progalgo, @RitvikDayal, @mjovanovic9999, @cskinner74, @gbyx3. Thank you.

Cowrie 2.5.0

Changes

  • Datadog output module (Fred Baguelin <[email protected]>)
  • General improvements to shell expansion handling
  • New version of Twisted supported
  • Python 3.11 support
  • Pypy 3.9 support
  • Add session type to Telegram output

Cowrie 2.4.0

Changes

  • Deprecate Python 3.7
  • Early support for Python 3.11
  • ThreatJammer output plugin (@diegoparrilla)
  • Telegram output plugin (@Louren)
  • Discord output plugin (@CyberSparkNL)
  • Updated mongodb output plugin
  • Dependency upgrades
  • Docker repo merged with this one
  • wget and curl rewritten using treq.
  • Migrate test framework from trial to unittest (@lazycrazyowl)

Cowrie 2.2.0

Changes

  • Deprecate Python 2.7 and 3.5
  • Command substitution with backticks (PeterSufliarsky)
  • Better chmod command line parsing (PeterSufliarsky)
  • Add uniq command (PeterSufliarsky)
  • Enhanced command substitution functionality.
  • Fix nc hang
  • Rename built-in user richard to phil, it's used as detection mechanism.
  • Binary suppport for cat, grep and other commands
  • Azure Sentinel output plugin

Cowrie 2.1.0

Changes

  • Deprecate Python 2.7. Still works but removed from testing suite and fixing 2.7 problems will no longer have priority.
  • Disable crashreporter
  • Updated ELK documentation and output plugin
  • tee command added. Updates to cat, dd and wc.
  • Fixed SSH compression issue with AsyncSSH client
  • AbuseIP output plugin.

Cowrie 2.0.0

Changes

  • Based on @sgtpepperpt's excellent work for GSoC we are now releasing Cowrie 2.0.0 with Proxy Support! Cowrie can now run in Proxy Mode and run a set of real live systems in the back-end using Qemu for more accurate backend simulation.

Cowrie 1.6.0

Changes

  • 2019-03-31 New documentation theme
  • 2019-03-23 Greynoise output plugin (@mzfr)
  • 2019-03-19 direct-tcp forwarding now written to databases (@gborges)
  • 2019-03-19 Reverse DNS output plugin (@mzfr)
  • 2019-03-17 Shell emulation pipe upgrade (@nunonovais)
  • 2019-03-14 Shell emulation environment variables improved (@nunonovais)
  • 2019-03-14 SSH crypto parameters now configurable in config file (@msharma)
  • 2019-03-13 Disable keyboard-interactive authentication by default with option to enable
  • 2019-03-13 Added wc, crontab, chpasswd command (@nunonovais)
  • 2019-
  • 2019-03-07 Output of ssh -V now configurable in cowrie.cfg with ssh_version setting
  • 2019-03-07 Multiple timezone support in cowrie.cfg timezone directive. Default timezone is now UTC for both cowrie.log and cowrie.json
  • 2019-03-12 Handle multiple password prompt. Option to enable or disable keyboard interactive prompt.

Cowrie 1.5.3

Changes

  • 2019-01-27 Telnet NAWS negotation removed to stop NMAP cowrie detection
  • 2019-01-27 Various fixes for Python2/3 compatibility
  • 2019-01-09 Documentation converted to ReStructuredText
  • 2018-12-04 Fixes for VT outut plugin to only submit new files

Cowrie 1.5.2

Changes

  • 2018-11-19 Fix tftp exception and tftp test
  • 2018-11-14 Remove dblog mechanism and splunk legacy output plugin.
  • 2018-11-01 Add Python3 support for Splunk output plugin
  • 2018-10-23 Improved free command
  • 2018-10-20 Improved uname command
  • 2018-10-16 Save VT results to JSON log

Cowrie 1.4.1

Changes

  • New docker file
  • Fix for unique hashes of TTY log files.

Cowrie Newsletter

Get monthly updates on Cowrie releases and security insights.