README.md


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42

Script to help make sense of log output from popular SSH honeypot [Cowrie](https://github.com/cowrie/cowrie/). I think I may have gotten carried away with the filtering settings and statistics aggregation. Untested with Telnet or proxy mode. YMMV

![Screenshot of Cowrieder's webpage output showing the data my Cowrie server had collected at the time and with the IPs redacted. It displays various basic statistics, including a couple snazzy pie charts. It also contains breakdowns of login combinations used by the clients sorted by username and source IP, a list of every password tried sorted by attempt count, and a window showing only the most interesting sessions.](https://isopod.cool/stuff/cowriederscreenshot.png)

# Usage

Simply point the script to a JSON log file output by Cowrie, or a folder thereof:

```
cowrieder.py <options> /path/to/your/log.json
cowrieder.py <options> /var/log/cowrie/
```

Options:

```
-h  -h, --help        show this help message and exit
-v, --verbose         Make the output more verbose (do less to collapse less-interesting information)
-V, --verboser        Make the output even more verbose (one line per event)
-W, --verbosest       Make the output even more verboserer (dump as much information as possible as pretty-printed JSON)
-P, --pings           Include only connections where no authentication attempt was made
-F, --fails           Include only failed logins
-L, --logins          Include only successful logins where no commands were run
-C, --commands        Include only logins where only this list of basic test commands were run: ['uname', 'nproc']
-E, --eventful        Include only the cool interesting sessions that aren't any of that other stuff
-u, --filter-username FILTER_USERNAME
                      Filter data to uses of a specific username
-p, --filter-password FILTER_PASSWORD
                      Filter data to uses of a specific password. Pass "[SSH_PUBKEY_ATTEMPT]" to filter for attempts to log in using an SSH public key instead of a password, which does happen
-z, --filter-sensor FILTER_SENSOR
                      Filter data to a certain "sensor". Useful if Cowrie is running in proxy mode to multiple endpoints
-i, --filter-ip FILTER_IP
                      Filter data to a specific IP, censored hash thereof, or netmask (127.0.0.1 / 0b39f7265d91e7c3 / 127.0.0.0/16)
-r, --redact-ip       Redact IP addresses by converting them to 16-character hashes
-c, --no-color        Don't color-code terminal output
-s, --stats           Print aggregated statistics
-S, --only-stats      Print only aggregated statistics
-m, --html            Output an overview as an HTML webpage, GoAccess-style. Ignores previous two options.
```

# TODO
- Filter by regex?