Changelog

Every Cowrie release, with the fixes and features that went into it. Dependency updates are counted rather than listed.

Release notes by emailRSS feedReleases on GitHub

Cowrie 3.0.15

Changes

  • Fix Earley shell-parser blow-up (#40597): unambiguous grammar, real pipelines and redirections #40611 by @micheloosterhof

Fixes

  • accept an empty password in userdb.txt #40521 by @micheloosterhof
  • parse /etc/passwd by line in finger #40525 by @micheloosterhof
  • prevent AlreadyQuit on clean shutdown for sqlite, mysql, postgresql plugins #40592 by @I-am-Krish
  • report a malformed cut field list instead of crashing #40529 by @micheloosterhof
  • use explicit collection_id for VirusTotal collections #40580 by @jarihu
  • annotate the finger test's passwd helper so mypy passes #40613 by @micheloosterhof
  • store directory modes, not decimal or file modes, for created directories #40612 by @micheloosterhof
  • raise ENOENT from fs.rmdir when the directory does not exist #40614 by @micheloosterhof
  • make fs.islink look at the entry instead of its target #40615 by @micheloosterhof
  • report an empty cp/mv destination instead of indexing it #40534 by @micheloosterhof

Maintenance

  • drop the unused backend_pool ping helper #40616 by @micheloosterhof
  • name the commit in the package version instead of a stale release number #40618 by @micheloosterhof
  • add setuptools-scm to the dev extra #40620 by @micheloosterhof
  • name the commit in the package version instead of a stale release number #40622 by @micheloosterhof

Plus 5 dependency updates.

Cowrie 3.0.14

Fixes

  • keep exec command usable when it is not valid UTF-8 #40520 by @micheloosterhof
  • register cowrie.urlhaus.submitted event id #40584 by @jarihu
  • rmdir and touch process all arguments #40596 by @nkbeast
  • space-separate ps COMMAND arguments #40549 by @micheloosterhof
  • write the shell prompt as UTF-8 #40544 by @micheloosterhof
  • escape attacker text in telegram messages #40543 by @micheloosterhof
  • decode the line buffer leniently for tab completion #40537 by @micheloosterhof
  • handle unknown curl content length #40445 by @cyphercodes
  • guard tab-completion against a missing client window size #40434 by @Sanjays2402
  • publish and reset the prometheus source-IP windows #40542 by @micheloosterhof
  • tolerate more malformed LLM prompt templates #40552 by @micheloosterhof
  • accept grep -m max-count #40594 by @AzazelSensei
  • guard printf against a malformed escape #40535 by @micheloosterhof

First contribution from @nkbeast, @cyphercodes, @Sanjays2402, @AzazelSensei. Thank you.

Plus 9 dependency updates.

Cowrie 3.0.13

Features

  • add URLhaus output plugin #40568 by @jarihu

Fixes

  • release integrity, ssh_proxy parity and DNS-rebinding in outbound downloads #40510 by @micheloosterhof
  • sqlite output drops file uploads and session input #40511 by @micheloosterhof
  • close the upload descriptor before renaming the temp file #40553 by @micheloosterhof
  • decode ttylog data leniently when converting to asciinema #40548 by @micheloosterhof
  • print real UTC in dig's WHEN line #40530 by @micheloosterhof
  • fall back to the default width on a non-numeric COLUMNS #40536 by @micheloosterhof
  • read rethinkdblog event timestamps as UTC #40538 by @micheloosterhof
  • log the proxy backend address as a string #40550 by @micheloosterhof
  • encode base64 interactive input as UTF-8 #40528 by @micheloosterhof
  • reassemble proxied SFTP messages by their length prefix #40557 by @micheloosterhof
  • keep the ftpget download running through CTRL-C #40556 by @micheloosterhof
  • expand an empty $@ / $* to no words #40554 by @micheloosterhof
  • handle a bare trailing CR in telnet proxy auth #40551 by @micheloosterhof
  • apply createfs's -v and -p flags #40547 by @micheloosterhof
  • reject a non-numeric uid/gid in fsctl chown/chgrp #40546 by @micheloosterhof
  • release misp session tracking when the session closes #40541 by @micheloosterhof
  • report an invalid grep pattern instead of raising re.error #40533 by @micheloosterhof
  • escape CEF extension values #40527 by @micheloosterhof
  • report whole days and years from durationHuman #40526 by @micheloosterhof
  • release dshield session state when the session closes #40540 by @micheloosterhof
  • append to the jsonlog logfile instead of truncating it #40524 by @micheloosterhof
  • let virustotal submit URLs it has never seen before #40522 by @micheloosterhof
  • hold a single sqlite connection in the output pool #40523 by @micheloosterhof
  • report the real size of an SFTP upload #40555 by @micheloosterhof
  • never stop an output plugin that failed to start #40576 by @micheloosterhof
  • report IPv6 download targets as unreachable #40582 by @micheloosterhof
  • report a malformed URL port in curl and wget #40545 by @micheloosterhof
  • survive an empty -c argument and non-UTF-8 stdin in sh #40531 by @micheloosterhof
  • decode bytes IP in ssh_proxy connect_to_backend for clean logging #40518 by @abhi-0203
  • catch OSError and process all arguments #40583 by @I-am-Krish

Maintenance

  • satisfy mypy on four test modules #40578 by @micheloosterhof
  • pin the auth answer the telnet proxy password test depends on #40577 by @micheloosterhof
  • pin the container's uid #40579 by @micheloosterhof
  • keep event ids, emitters, consumers and docs in step #40575 by @micheloosterhof

First contribution from @jarihu, @abhi-0203, @I-am-Krish. Thank you.

Plus 11 dependency updates.

Cowrie 3.0.12

Fixes

  • cap the size of shell input fed to the parser #40441 by @micheloosterhof
  • strip pip, setuptools and wheel from the runtime venv #40446 by @micheloosterhof

Plus 6 dependency updates.

Cowrie 3.0.11

Changes

  • fingerprinting with CI #2791 by @micheloosterhof
  • share the honeyfs tree across sessions (copy-on-write) #40387 by @micheloosterhof
  • Wait for async commands (wget/curl) in command substitution #40425 by @micheloosterhof
  • Give each shell its own working directory #40428 by @micheloosterhof
  • Output plugin cleanups: remove crashreporter, fix slack client reuse and timestamp option #40426 by @micheloosterhof
  • Give each shell its own user identity #40429 by @micheloosterhof
  • Feed a pipeline stage that finishes asynchronously (wget URL | sh) #40431 by @micheloosterhof
  • Keep a command's stdio wiring on the command #40430 by @micheloosterhof

Features

  • read stdin in grep when no files are given #40371 by @micheloosterhof
  • support the HAProxy PROXY protocol #40372 by @micheloosterhof
  • add a nix flake #40433 by @micheloosterhof

Fixes

  • run long pipelines flat instead of recursing per stage #40373 by @micheloosterhof
  • handle GreyNoise request failures instead of erroring #40374 by @micheloosterhof
  • handle failed HTTP requests in output plugins #40375 by @micheloosterhof
  • flush buffered frontend packets in proxy mode #40376 by @micheloosterhof
  • survive terminalProtocol teardown mid-dataReceived #40268 by @micheloosterhof
  • ignore CHANNEL_WINDOW_ADJUST for already-closed channels #40378 by @micheloosterhof
  • treat a bare = as a command name, not an assignment #40379 by @micheloosterhof
  • abort downloads that exceed download_limit_size #40380 by @micheloosterhof
  • treat an empty symlink target as a broken link #40398 by @micheloosterhof
  • re-authenticate returning attackers in AuthRandom #40400 by @micheloosterhof
  • use posixpath for emulated-filesystem paths (Windows support) #40403 by @micheloosterhof
  • make the outbound rate limiter case-insensitive per host #40406 by @micheloosterhof
  • apply rate limit, size limit and outbound bind to ftpget #40407 by @micheloosterhof
  • move wget/curl/nc rate-limit options to [shell] and document them #40408 by @micheloosterhof
  • harden DB output plugins against error-handler crashes and NULL-string rows #40409 by @micheloosterhof
  • harden scp upload parsing against crashes and file floods #40410 by @micheloosterhof
  • don't crash on attacker-controlled bytes that aren't valid UTF-8 #40412 by @micheloosterhof
  • harden telnet subsystem against malformed client input #40411 by @micheloosterhof
  • harden the LLM backend against attacker input and runaway API use #40413 by @micheloosterhof
  • refuse an out-of-sequence keyboard-interactive INFO_RESPONSE #40414 by @micheloosterhof
  • cache reversedns results instead of spent Deferreds #40417 by @micheloosterhof
  • reconcile event id consumers with the ids Cowrie emits #40420 by @micheloosterhof
  • ignore CHANNEL_REQUEST for an unknown or closed channel #40419 by @micheloosterhof
  • tftp IPv6 crash, missing rate limiter, unenforced size limit, and resolution TOCTOU (#40394) #40422 by @micheloosterhof
  • name temp backing files with a prefix and uuid #40421 by @micheloosterhof
  • nc no longer blocks the reactor with stdlib sockets #40424 by @micheloosterhof
  • declare ILogObserver on the log observer factory #40427 by @micheloosterhof

Maintenance

  • pin all GitHub Actions to full commit SHAs #40363 by @micheloosterhof
  • add security policy (SECURITY.md) #40366 by @micheloosterhof
  • add changelog and issues project URLs #40367 by @micheloosterhof
  • reproducible build metadata and runtime hardening #40364 by @micheloosterhof
  • add pip-audit dependency vulnerability scanning #40365 by @micheloosterhof
  • dispatch docker and pypi publish workflows from weekly release #40377 by @micheloosterhof
  • make pyright usable, then fix everything it finds #40392 by @micheloosterhof
  • plain-language overhaul of the documentation tree #40418 by @micheloosterhof
  • prune vacuous, tautological, and duplicate tests #40432 by @micheloosterhof

Plus 10 dependency updates.

Cowrie 3.0.10

Features

  • kafka output based on aiokafka #40355 by @micheloosterhof
  • kafka output based on aiokafka #40326 by @rwakulszowa

Fixes

  • accept bare-CR line endings at the telnet login prompt (PuTTY) #40344 by @micheloosterhof
  • stop logging a traceback for malformed telnet IAC traffic #40345 by @micheloosterhof

First contribution from @rwakulszowa. Thank you.

Cowrie 3.0.9

Fixes

  • prevent session hang from IPv4-embedded IPv6 download URLs #40336 by @micheloosterhof
  • handle TCP connect timeout in curl and wget downloads #40337 by @micheloosterhof
  • derive OptionParsingError from Exception #40339 by @micheloosterhof
  • resolve tftp target hostname before UDP I/O #40340 by @micheloosterhof
  • drop OpenSSH host-key rotation requests in ssh proxy #40341 by @micheloosterhof
  • run a shell reading channel stdin when bash is the exec command #40342 by @micheloosterhof
  • bind outbound downloads to out_addr so they don't leak the server IP #40343 by @micheloosterhof

Maintenance

  • bump mypy to 2.3.0 and mypy-zope to 1.0.16 #40338 by @micheloosterhof

Plus 3 dependency updates.

Cowrie 3.0.8

Fixes

  • block IPv4-mapped and embedded-IPv4 IPv6 addresses in outbound filter #40329 by @micheloosterhof
  • block non-globally-routable outbound targets #40330 by @micheloosterhof

Cowrie 3.0.7

Changes

  • fix broken postgresql output #40313 by @dongdigua

Features

  • support the exec shell builtin #40308 by @micheloosterhof

Fixes

  • guard against None transport in sendPacket (#40324) #40325 by @fazalpsinfo-cmyk

First contribution from @fazalpsinfo-cmyk, @dongdigua. Thank you.

Plus 9 dependency updates.

Cowrie 3.0.6

Changes

  • reduce duplicate-download logging to one congruent message #40270 by @micheloosterhof
  • Session-scoped event pipeline: attribute events at emission, delete the log-observer path #40286 by @micheloosterhof

Features

  • config-driven log levels and per-class twisted.logger diagnostics #40312 by @micheloosterhof

Fixes

  • clean up unhandled wget error logging #40259 by @micheloosterhof
  • release file handle before renaming captured logs on Windows #40260 by @micheloosterhof
  • reset exec idle timeout on inbound stdin #40261 by @micheloosterhof
  • capture exec-channel stdin in cat redirect output #40262 by @micheloosterhof
  • report bundled-resource directory reads as FileNotFoundError #40263 by @micheloosterhof
  • handle empty path in resolve_path and file tests #40266 by @micheloosterhof
  • avoid ZeroDivisionError in wget speed calculation #40267 by @micheloosterhof
  • drop and log malformed SSH packets instead of crashing #40264 by @micheloosterhof
  • annotate treq header dicts to match the expected type #40272 by @micheloosterhof
  • run async commands in scripts sequentially without cmdstack corruption #40273 by @micheloosterhof
  • keep the session alive when exit runs inside a command substitution #40276 by @micheloosterhof
  • make late tftp download callbacks safe after session close #40280 by @micheloosterhof
  • parse input queued while a command is running #40299 by @micheloosterhof
  • log telnet process end as an exit status, not a Failure repr #40300 by @micheloosterhof
  • write each jsonlog event in a single call to survive rotation #40301 by @micheloosterhof
  • survive a late second exit() from pending download callbacks #40274 by @micheloosterhof
  • queue mid-command input on the innermost shell #40303 by @micheloosterhof
  • ignore channel EOF/CLOSE for already-closed SSH channels #40305 by @micheloosterhof
  • resolve CNAME chains and AAAA records in communication_allowed #40307 by @micheloosterhof

Maintenance

  • upgrade treq to 26.7.0 and drop requests/urllib3 #40271 by @micheloosterhof
  • register the fake async command without shadowing the ClassVar #40302 by @micheloosterhof
  • build bcrypt from git on free-threaded 3.15 #40304 by @micheloosterhof
  • capture late download events through the session EventLog #40306 by @micheloosterhof

Plus 15 dependency updates.

Cowrie 3.0.5

Changes

  • Real command exit status: $?, && / ||, and exec exit-status #40222 by @micheloosterhof
  • Translate emulated-filesystem errors at the SFTP boundary #40223 by @micheloosterhof
  • Report "Bad file descriptor" for an out-of-range redirect fd #40224 by @micheloosterhof
  • Register backing files for command-less output redirections #40226 by @micheloosterhof
  • Discard data that arrives after the terminal protocol is torn down #40227 by @micheloosterhof
  • Remove empty download artifacts on early wget/curl exits #40228 by @micheloosterhof
  • Report "Is a directory" instead of disconnecting on a directory command #40229 by @micheloosterhof
  • Reject binary files passed to sh/bash instead of parsing their bytes #40230 by @micheloosterhof
  • Log a failed DNS lookup at info level, not as an "Unhandled Error" #40231 by @micheloosterhof
  • Comment on and collect VirusTotal uploads by file hash, not analysis id #40234 by @micheloosterhof
  • Log each telnet option negotiation once per connection #40232 by @micheloosterhof
  • Added OCSF output #40233 by @JustSamAgain
  • Reuse an existing VirusTotal collection instead of re-creating it #40235 by @micheloosterhof

Features

  • replace the shlex shell parser with a Lark grammar #40219 by @micheloosterhof
  • add su command for switching user identity #40212 by @micheloosterhof
  • emulate shell flow control (for/if/while/until/case, functions, test/[) #40243 by @micheloosterhof

Fixes

  • disconnect cleanly on duplicate KEXINIT during key exchange #40206 by @micheloosterhof
  • check init before stop/force-stop/status #40236 by @micheloosterhof
  • handle invalid IAC byte in telnet without crashing (#40218) #40239 by @micheloosterhof
  • escape non-printable bytes in logged untrusted input #40240 by @micheloosterhof
  • correct ConnectingDone typo in wget error handling #40242 by @micheloosterhof
  • tftp downloads produce empty hashes and crash the VirusTotal output #40241 by @micheloosterhof
  • type telnet transport protocol mock in test #40245 by @micheloosterhof

Maintenance

  • publish the docker image only from release tags #40220 by @micheloosterhof

First contribution from @JustSamAgain. Thank you.

Plus 5 dependency updates.

Cowrie 3.0.4

Changes

  • recording "last command" for DShield #40162 by @jullrich
  • Update requirements-output.txt #40155 by @TrueDru
  • Fix/cmdstack leak no input #40170 by @micheloosterhof
  • Address pyright diagnostics: real bugs and noise reduction #40190 by @micheloosterhof
  • Report directory and missing path-like commands with shell-accurate errors #40194 by @micheloosterhof

Features

  • implement chpasswd command simulation with logging #40144 by @Sanchitha408

Fixes

  • send bare LF on PTY-less exec channels #40169 by @micheloosterhof
  • persist shell variables and separate exported environment #40171 by @micheloosterhof
  • count nested subshells in command substitution #40173 by @micheloosterhof
  • emit session and TTY-log duration as integer milliseconds (duration_ms) #40175 by @micheloosterhof
  • look up MISP malware samples by MD5 #40191 by @micheloosterhof
  • save scp uploads as file content, not SCP wire framing #40196 by @micheloosterhof
  • stop telnet negotiation retries from crashing connection teardown #40198 by @micheloosterhof
  • deliver SSH session connectionLost exactly once on teardown #40200 by @micheloosterhof
  • skip stdin-log save when exec session sent no input #40199 by @micheloosterhof
  • honour output redirection for busybox-dispatched applets #40202 by @micheloosterhof
  • ignore NUL bytes in interactive shell instead of logging a warning #40201 by @micheloosterhof
  • restore initial NAWS negotiation for telnet connections #40204 by @micheloosterhof
  • resolve mypy errors in MISP output plugin and tests #40203 by @micheloosterhof
  • remove orphaned temp file on failed wget/curl download #40205 by @micheloosterhof

First contribution from @TrueDru, @Sanchitha408. Thank you.

Plus 7 dependency updates.

Cowrie 3.0.0

Changes

  • Port dshield to treq, adopt modern submitapi, fix enrichment race #40119 by @micheloosterhof

Features

  • pip-installable cowrie state directory model #40138 by @micheloosterhof

Maintenance

  • fix mypy on Python 3.15 stubs; drop unused tftpy dependency #40141 by @micheloosterhof

Plus 4 dependency updates.

Cowrie 2.9.20

Features

  • embed file contents into bundled fs.pickle #40137 by @micheloosterhof

Fixes

  • read issue.net banner as UTF-8 with replacement #40136 by @micheloosterhof

Maintenance

  • delay non-security updates with 7-day cooldown #40129 by @micheloosterhof

Plus 9 dependency updates.

Cowrie 2.9.19

Changes

  • Bump default emulated OS fingerprint to Debian 12 / kernel 6.1 #40090 by @Bierchermuesli
  • Realign tests for Debian 12 fs.pickle; promote dump tool to cowrie.scripts.dumpfs #40101 by @micheloosterhof
  • Clean up artifacts that leaked through #40101 squash-merge #40102 by @micheloosterhof
  • license: add SPDX headers and REUSE compliance #2935 by @micheloosterhof
  • Bump Twisted to 26.4.0 and adopt its stricter typing #40117 by @micheloosterhof
  • Port malshare and cuckoo output plugins to treq #40118 by @micheloosterhof

Maintenance

  • type test_tftp.py and test_ftpget.py properly for mypy #40111 by @micheloosterhof

Plus 13 dependency updates.

Cowrie 2.9.18

Changes

  • LLM Anthropic support + Configurable context prompt #38602 by @Bierchermuesli

Plus 6 dependency updates.

Cowrie 2.9.16

Changes

  • Proxy support for llm backend #34061 by @Bierchermuesli
  • ifconfig & netstate IPv6 aware #2912 by @Bierchermuesli

Fixes

  • resolve mypy type errors in LLM client #40081 by @micheloosterhof

First contribution from @Bierchermuesli. Thank you.

Plus 6 dependency updates.

Cowrie 2.9.15

Changes

  • Fix chattr: remove Command_nop as it overshadow the command #2931 by @statzitz

First contribution from @statzitz. Thank you.

Plus 2 dependency updates.

Cowrie 2.9.12

Changes

  • Devops work #2905 by @micheloosterhof
  • Execute shell scripts #2908 by @micheloosterhof

Maintenance

  • upgrade to Debian 13 (trixie) / Python 3.13 #2906 by @micheloosterhof
  • fix duplicate tox runs on Dependabot PRs #2907 by @micheloosterhof

Plus 1 dependency update.

Cowrie 2.9.11

Changes

  • Modernize Python patterns for 3.10+ across codebase #2903 by @micheloosterhof

Plus 5 dependency updates.

Cowrie 2.9.10

Changes

  • Add cut command for shell mode #2895 by @micheloosterhof

Plus 2 dependency updates.

Cowrie 2.9.9

Changes

  • Add CVE-2026-24061 vulnerability emulation for telnet #2891 by @micheloosterhof

Fixes

  • prevent recursion when onResult is None #2892 by @micheloosterhof
  • backend_pool throwing NAT errors in remote mode when client_protocol is not initialized/closed #2881 by @NathanAdhitya

Maintenance

  • enable PyO3 ABI3 forward compatibility for Python 3.15 #2884 by @micheloosterhof

Plus 5 dependency updates.

Cowrie 2.9.8

Changes

  • Add CVE-2026-24061 exploit detection for telnet NEW-ENVIRON option #2883 by @micheloosterhof

Fixes

  • wget saves files to cwd instead of root #2875 by @micheloosterhof
  • handle PackageNotFoundError in conf.py and fix RST title l… #2882 by @micheloosterhof

Plus 5 dependency updates.

Cowrie 2.9.7

Changes

  • 3.11->3.12 for readthedocs #2873 by @micheloosterhof

Fixes

  • backend_pool throwing NAT errors in remote mode when client_protocol is not intialized yet #2864 by @NathanAdhitya

Maintenance

  • add local SSH testing instructions #2862 by @Mutsawashe2006

First contribution from @NathanAdhitya, @Mutsawashe2006. Thank you.

Plus 7 dependency updates.

Cowrie 2.9.5

Fixes

  • pin cosign to v2.4.1 for Docker Hub compatibility #2855 by @micheloosterhof

Cowrie 2.9.4

Fixes

  • SSRF protection bypass in ftpget, tftp, and nc commands #2852 by @micheloosterhof

Cowrie 2.9.3

Changes

  • Pr 2827 improve backend logging #2843 by @micheloosterhof

Fixes

  • improve FD redirection parsing and refactor shell modules #2849 by @micheloosterhof
  • playlog now shows output for exec sessions #2850 by @micheloosterhof

Plus 3 dependency updates.

Cowrie 2.9.2

Changes

  • Refactor sleep command with improved option handling #2822 by @filippolauria

Fixes

  • resolve variable/method shadowing bugs #2840 by @micheloosterhof
  • chmod --help and --version were broken #2841 by @micheloosterhof

Maintenance

  • use native ARM64 runner for faster Docker builds #2842 by @micheloosterhof
  • add SSH proxy smoke tests #2844 by @micheloosterhof

Plus 3 dependency updates.

Cowrie 2.9.1

Changes

  • swap cosign arguments and commands #2813 by @micheloosterhof
  • self.write->self.errorWrite #2812 by @micheloosterhof
  • Improve nc command realism and add abuse protection #2815 by @filippolauria
  • Fix Proxy mode failing to start #2825 by @Weijo
  • Add weekly automated release workflow #2836 by @micheloosterhof
  • Fix error on fs tab completion for non-existing dirs #2835 by @Caleb-Wishart

First contribution from @Weijo, @Caleb-Wishart. Thank you.

Plus 8 dependency updates.

Cowrie 2.9.0

Changes

  • Various fixes #2765 by @micheloosterhof
  • ga4 #2766 by @micheloosterhof
  • Awk #2767 by @micheloosterhof
  • Ja4 fingerprinting #2773 by @micheloosterhof
  • update docs for nft and other tweaks #2774 by @micheloosterhof
  • Dock #2768 by @micheloosterhof
  • Support FTP URLs in wget command #2787 by @CoreZen
  • Update ifconfig to add more realistic packet / byte counts #2804 by @e991f665b7e62df5a54fdef19053a4e75117b89
  • Add rate limiting to prevent DDoS abuse and improve wget command #2800 by @filippolauria
  • Update OUTPUT.rst with events currently not present #2429 by @marcopedrinazzi
  • LLM backend for cowrie (openAI for now) #2809 by @micheloosterhof
  • Add Python 3.15 testing (allowed to fail) #2810 by @micheloosterhof
  • bump version #2811 by @micheloosterhof

Features

  • improve Discord webhook plugin with queue-based retry and rate-limit handling #2798 by @CoreZen

Maintenance

  • fix typos in some files #2796 by @Edge-Seven

First contribution from @Edge-Seven, @CoreZen, @e991f665b7e62df5a54fdef19053a4e75117b89, @filippolauria, @marcopedrinazzi. Thank you.

Cowrie 2.8.1

Changes

  • Deprecate python 3.9 #2747 by @micheloosterhof
  • Python 3.14 support #2760 by @micheloosterhof
  • VirusTotal v3 support #2755 by @micheloosterhof
  • Ftp async rewrite #2758 by @micheloosterhof
  • Tftp async rewrite #2759 by @micheloosterhof
  • add protocol in event log #2762 by @micheloosterhof
  • UUID #2763 by @micheloosterhof

Cowrie 2.8.0

Changes

  • Pypi #2744 by @micheloosterhof
  • better docker tags #2726 by @micheloosterhof
  • partially functional chmod #2732 by @micheloosterhof
  • packaging updates #2733 by @micheloosterhof
  • Update requirements handling and documentation #2734 by @micheloosterhof
  • Run without full directory structure (pip install) #2739 by @micheloosterhof

Cowrie 2.7.0

Breaking changes

Changes

  • Install Cowrie into your virtual environment with pip install -e .
  • bin/ directory removed: Scripts asciinema, createfs, fsctl, and playlog are no longer called from the bin/ directory.
  • Python 3.9 no longer supported: Minimum Python version is now 3.10.
  • SQL schema update required: If using MySQL/SQLite databases, run the migration script docs/sql/update16.sql to extend IP address fields for IPv6 support (VARCHAR length increased to 61 characters).
  • SSH-DSS key support removed: The deprecated ssh-dss algorithm is no longer supported for improved security. Remove ssh-dss configuration if you use it.
  • New Output Plugins:
  • PostgreSQL output plugin with automatic reconnection support
  • Prometheus metrics output plugin for monitoring and alerting
  • New Shell Commands:
  • find command with basic options for file searching
  • dig command for DNS lookups
  • git command for version control simulation
  • curl command now supports HEAD requests with -I option
  • Enhanced Security:
  • Network blocking for outbound connections from wget/curl/nc to reserved IP ranges
  • Null byte password protection to prevent authentication bypasses
  • Updated SSH algorithms and key management for better security posture
  • Proxy Mode Improvements:
  • SFTP file transfers now logged and captured in proxy mode
  • Better SSH factory handling for improved stability
  • New configuration options available for:
  • PostgreSQL output plugin settings
  • Prometheus metrics endpoint configuration
  • Network blocking controls for command simulation
  • Docker:
  • Improved local build support
  • Docker:
  • Improved local build support
  • Container signing with Cosign for supply chain security
  • Updated base images and metadata
  • Build System:
  • Migrated to setuptools-scm for automatic version management
  • PyPI package publishing now automated as trial for future development
  • Dependencies:
  • Twisted updated to 25.5.0
  • Elasticsearch client updated to 9.x
  • Various security updates across all dependencies
  • Enhanced MISP output plugin with overcuriosity protection and better threat intelligence integration
  • Simplified Slack output formatting for better readability
  • Better shell command substitution and subshell execution
  • Improved error handling in wget with explicit timeouts
  • ECS-compliant Logstash configuration template
  • Enhanced history handling in shell sessions
  • Added Python 3.14 development version support
  • Added PyPy 3.11 support
  • Improved test coverage and CI/CD pipelines

Cowrie 2.6.1

Changes

  • Devops #1811 by @micheloosterhof
  • Versionstringfix #1817 by @micheloosterhof
  • fix macs typo in cowrie.cfg.dist #1820 by @paseaf
  • Support for additional commands #1830 by @Masood-M
  • Correct description of the authentication_timeout setting in the conf… #1833 by @onlyvae
  • [Snyk] Security upgrade requests from 2.28.1 to 2.31.0 #1838 by @micheloosterhof
  • Reqs #1841 by @micheloosterhof
  • docker update #1842 by @micheloosterhof
  • platforms #1843 by @micheloosterhof
  • Dock3 #1844 by @micheloosterhof
  • updated #1845 by @micheloosterhof
  • don't use build/push together #1846 by @micheloosterhof
  • fix sftp ls #1853 by @micheloosterhof
  • pur->dependabot #1854 by @micheloosterhof
  • pyyaml->6.0.1 #1860 by @micheloosterhof
  • Mypy aug #1872 by @micheloosterhof
  • datadog: allow configuration of hostname #1866 by @galenguyer
  • fix docs #1886 by @micheloosterhof
  • rtd->py3.10 #1894 by @micheloosterhof
  • 3.12 allowed failures #1879 by @micheloosterhof
  • new format #1896 by @micheloosterhof
  • 23.8 #1907 by @micheloosterhof
  • Classvar new ruff version #1912 by @micheloosterhof
  • don't give exception if file download has failed #1913 by @micheloosterhof
  • scripts can now be run, and pip install -e works #1927 by @micheloosterhof
  • py 3.12 and pypy 3.10 #1952 by @micheloosterhof
  • pyupgrade38plus #1953 by @micheloosterhof
  • only run docker login in main repo #1955 by @micheloosterhof
  • different syntax for run because there's no shell #1962 by @micheloosterhof
  • 17oct #1968 by @micheloosterhof
  • update hpfeeds version #1979 by @D1sD3s
  • Oracle cloud custom logs plugin #1997 by @mamorett
  • fix regex to do explit dot #2008 by @micheloosterhof
  • remove duplicate code #2010 by @micheloosterhof
  • Patched fsctl as noted in PR #2009 #2011 by @halcyondream
  • Updated fsctl.py #2013 by @halcyondream
  • docker image updates through dependabit #2040 by @micheloosterhof
  • Removed DAEMONIZE steps. #1983 by @adam-qomodo
  • load cowrie path #2061 by @micheloosterhof
  • add suggestion from issue #1650 #2062 by @micheloosterhof
  • update reqs. #2077 by @micheloosterhof
  • [Snyk] Security upgrade cryptography from 42.0.1 to 42.0.2 #2082 by @micheloosterhof
  • ruff 0.2.1 #2090 by @micheloosterhof
  • Pyright #2091 by @micheloosterhof
  • remove custom ssl context factories #2135 by @micheloosterhof
  • new way to disable https checks #2136 by @micheloosterhof
  • Fix formatting in README.rst #2146 by @progalgo
  • Fix formatting in README.rst #2150 by @progalgo
  • [Snyk] Security upgrade cryptography from 42.0.5 to 42.0.6 #2165 by @micheloosterhof
  • formatting #2168 by @micheloosterhof
  • remove python 3.8 #2170 by @micheloosterhof
  • small shell fixes #2199 by @micheloosterhof
  • [Snyk] Security upgrade cryptography from 42.0.6 to 42.0.8 #2206 by @micheloosterhof
  • proxy fixes and improvements #2204 by @micheloosterhof
  • #1756 / added-support-for-h-flag-in-ls-comand #2217 by @RitvikDayal
  • display full path as specified for individual files #2218 by @micheloosterhof
  • revert - #2217 #2219 by @RitvikDayal
  • #1756 / added-support-for-h-flag-in-ls-comand #2220 by @RitvikDayal
  • ruff -> ruff check #2227 by @micheloosterhof
  • check if user is still connected. #2229 by @micheloosterhof
  • fix #2257 #2280 by @micheloosterhof
  • keep running commands on exec mode after first one fails. #2281 by @micheloosterhof
  • remove threatjammer. domain is gone. #2282 by @micheloosterhof
  • remove threatjammer from index #2283 by @micheloosterhof
  • fix #2291 #2302 by @micheloosterhof
  • proper Guest dataclass usage #2304 by @mjovanovic9999
  • Added support for remote syslog logging #2312 by @mjovanovic9999
  • update head to take -c. update quotes for remotesyslog #2318 by @micheloosterhof
  • treq -> 24.9.0 #2320 by @micheloosterhof
  • 3.13-dev #2321 by @micheloosterhof
  • black formatting #2328 by @micheloosterhof
  • Update locaksyslog.py #2325 by @cskinner74
  • add lspci #2329 by @micheloosterhof
  • Debian package updates #2330 by @micheloosterhof
  • Reduce dependencies #2335 by @micheloosterhof
  • Deps3 #2336 by @micheloosterhof
  • 21oct #2354 by @micheloosterhof
  • User #2356 by @micheloosterhof
  • Updated Graylog docs to also describe the pipeline feature #2355 by @gbyx3
  • Explicit deps #2358 by @micheloosterhof
  • Twisted2410 #2360 by @micheloosterhof
  • Disable oci python dependency #2367 by @micheloosterhof
  • Urllib #2378 by @micheloosterhof
  • Increq #2379 by @micheloosterhof
  • Defaults #2192 by @micheloosterhof
  • Devops #2380 by @micheloosterhof
  • Datadir #2381 by @micheloosterhof
  • file system fixes #2389 by @micheloosterhof
  • add option to login with any public key #2391 by @micheloosterhof
  • update issue templates #2392 by @micheloosterhof
  • fix for crashing ping command #2393 by @micheloosterhof
  • print which config files are used #2395 by @micheloosterhof
  • rmq #2396 by @micheloosterhof
  • pool reqs #1970 by @micheloosterhof
  • 22nov #2398 by @micheloosterhof
  • flags for ps to work on busybox. #2399 by @micheloosterhof
  • remove blowfish #2406 by @micheloosterhof
  • Ruff8 #2407 by @micheloosterhof
  • fix crash with 0 arguments #2408 by @micheloosterhof

Maintenance

  • debian bullseye to bookworm #1940 by @micheloosterhof

First contribution from @paseaf, @Masood-M, @onlyvae, @galenguyer, @D1sD3s, @mamorett, @halcyondream, @adam-qomodo, @progalgo, @RitvikDayal, @mjovanovic9999, @cskinner74, @gbyx3. Thank you.

Cowrie 2.5.0

Changes

  • Datadog output module (Fred Baguelin <[email protected]>)
  • General improvements to shell expansion handling
  • New version of Twisted supported
  • Python 3.11 support
  • Pypy 3.9 support
  • Add session type to Telegram output

Cowrie 2.4.0

Changes

  • Deprecate Python 3.7
  • Early support for Python 3.11
  • ThreatJammer output plugin (@diegoparrilla)
  • Telegram output plugin (@Louren)
  • Discord output plugin (@CyberSparkNL)
  • Updated mongodb output plugin
  • Dependency upgrades
  • Docker repo merged with this one
  • wget and curl rewritten using treq.
  • Migrate test framework from trial to unittest (@lazycrazyowl)

Cowrie 2.2.0

Changes

  • Deprecate Python 2.7 and 3.5
  • Command substitution with backticks (PeterSufliarsky)
  • Better chmod command line parsing (PeterSufliarsky)
  • Add uniq command (PeterSufliarsky)
  • Enhanced command substitution functionality.
  • Fix nc hang
  • Rename built-in user richard to phil, it's used as detection mechanism.
  • Binary suppport for cat, grep and other commands
  • Azure Sentinel output plugin

Cowrie 2.1.0

Changes

  • Deprecate Python 2.7. Still works but removed from testing suite and fixing 2.7 problems will no longer have priority.
  • Disable crashreporter
  • Updated ELK documentation and output plugin
  • tee command added. Updates to cat, dd and wc.
  • Fixed SSH compression issue with AsyncSSH client
  • AbuseIP output plugin.

Cowrie 2.0.0

Changes

  • Based on @sgtpepperpt's excellent work for GSoC we are now releasing Cowrie 2.0.0 with Proxy Support! Cowrie can now run in Proxy Mode and run a set of real live systems in the back-end using Qemu for more accurate backend simulation.

Cowrie 1.6.0

Changes

  • 2019-03-31 New documentation theme
  • 2019-03-23 Greynoise output plugin (@mzfr)
  • 2019-03-19 direct-tcp forwarding now written to databases (@gborges)
  • 2019-03-19 Reverse DNS output plugin (@mzfr)
  • 2019-03-17 Shell emulation pipe upgrade (@nunonovais)
  • 2019-03-14 Shell emulation environment variables improved (@nunonovais)
  • 2019-03-14 SSH crypto parameters now configurable in config file (@msharma)
  • 2019-03-13 Disable keyboard-interactive authentication by default with option to enable
  • 2019-03-13 Added wc, crontab, chpasswd command (@nunonovais)
  • 2019-
  • 2019-03-07 Output of ssh -V now configurable in cowrie.cfg with ssh_version setting
  • 2019-03-07 Multiple timezone support in cowrie.cfg timezone directive. Default timezone is now UTC for both cowrie.log and cowrie.json
  • 2019-03-12 Handle multiple password prompt. Option to enable or disable keyboard interactive prompt.

Cowrie 1.5.3

Changes

  • 2019-01-27 Telnet NAWS negotation removed to stop NMAP cowrie detection
  • 2019-01-27 Various fixes for Python2/3 compatibility
  • 2019-01-09 Documentation converted to ReStructuredText
  • 2018-12-04 Fixes for VT outut plugin to only submit new files

Cowrie 1.5.2

Changes

  • 2018-11-19 Fix tftp exception and tftp test
  • 2018-11-14 Remove dblog mechanism and splunk legacy output plugin.
  • 2018-11-01 Add Python3 support for Splunk output plugin
  • 2018-10-23 Improved free command
  • 2018-10-20 Improved uname command
  • 2018-10-16 Save VT results to JSON log

Cowrie 1.4.1

Changes

  • New docker file
  • Fix for unique hashes of TTY log files.

Cowrie Newsletter

Get monthly updates on Cowrie releases and security insights.