How to replay attacker sessions from Kippo logs?

Use the utils/playlog.py utility to replay logs stored in log/tty/, which maintains original timings for accurate behavioral analysis. This allows step-by-step review of shell interactions.

Is Kippo or Cowrie better for SSH honeypotting?

Cowrie, the fork mentioned in the README, is more actively maintained and updated, while Kippo is older with outdated dependencies. For modern needs, Cowrie is generally recommended over the original Kippo.

What Python version does Kippo need?

Kippo requires Python 2.5 or higher, as stated in the Requirements, but this is problematic since Python 2 is end-of-life, posing compatibility and security issues.

How to set up Kippo to monitor SSH attacks?

Edit kippo.cfg to configure settings, use ./start.sh to run it on port 2222 (or forward ports), and ensure dependencies like Twisted and PyCrypto are installed, as per the Wiki instructions.

Can Kippo handle a lot of simultaneous SSH connections?

As a medium interaction honeypot, Kippo may not scale well for high-volume attacks; it's designed for logging and analysis rather than performance, so it might struggle under heavy load.

Is Kippo safe to use on my network?

The FAQ only says 'Maybe,' so it should be deployed in isolated environments with monitoring. Since it attracts malicious traffic, improper setup could risk network exposure.

Open-Awesome

Kippo

Pythonv0.9

A medium interaction SSH honeypot that logs brute force attacks and attacker shell interactions.

GitHub

1.7k stars278 forks0 contributors

What is Kippo?

Kippo is a medium interaction SSH honeypot that logs brute force attacks and captures the entire shell interaction performed by attackers. It creates a fake filesystem resembling a Debian installation to deceive attackers and study their techniques in a safe environment.

Target Audience

Security researchers, system administrators, and cybersecurity professionals who want to monitor and analyze SSH-based attacks on their networks.

Value Proposition

Developers choose Kippo for its realistic deception capabilities, detailed session logging, and ability to capture attacker behavior without risking real systems, making it a valuable tool for threat intelligence.

Overview

Kippo - SSH Honeypot

Use Cases

Best For

Monitoring SSH brute force attacks on your network
Capturing and analyzing attacker shell interactions
Studying attack patterns and techniques in a controlled environment
Creating a deceptive SSH server to gather threat intelligence
Logging files downloaded by attackers via wget
Replaying attacker sessions with original timings for analysis

Not Ideal For

Organizations requiring actively maintained and updated security tools
High-traffic environments needing scalable, production-ready honeypot solutions
Teams without Python 2.x expertise or those seeking modern dependency management

Pros & Cons

Pros

Realistic Fake Filesystem

Emulates a full Debian 5.0 installation with customizable fake file contents, allowing attackers to 'cat' files like /etc/passwd for deceptive realism.

Detailed Session Logging

Stores session logs in UML-compatible format in the log/tty/ directory, enabling replay with original timings via utils/playlog.py for precise analysis.

File Download Capture

Automatically saves files downloaded via wget to the dl/ folder, as noted in the features, facilitating forensic inspection of attacker activities.

Deceptive Interaction Controls

Implements trickery such as preventing exit commands from working and fake SSH connections, misleading attackers into prolonged engagement.

Cons

Outdated Technology Stack

Relies on Python 2.5+ and specific Twisted versions (8.0 to 15.1.0), which are deprecated and may harbor security vulnerabilities due to lack of updates.

Inactive Project Maintenance

The README directs users to a fork for recent development, indicating this version is no longer actively maintained or supported.

Vague Security Assurance

The FAQ only answers 'Maybe.' to security questions, lacking comprehensive documentation on risks, making it uncertain for safe deployment.

Frequently Asked Questions

Related Projects

awesome-honeypots

an awesome list of honeypot resources

Stars10,611

Forks1,379

Last commit4 months ago

T-Pot

🍯 T-Pot - The All In One Multi Honeypot Platform 🐝

SSH tarpit that slowly sends an endless banner

Stars8,564

Forks305

Last commit2 years ago

Cowrie

Cowrie SSH/Telnet Honeypot https://docs.cowrie.org/

Stars6,615

Forks1,082

Last commit3 days ago

Community-curated · Updated weekly · 100% open source

Found a gem we're missing?

Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.

Submit a project Star on GitHub