A modified OpenSSH daemon that forwards attacker commands to Cowrie for logging and interaction interpretation.
The sshd-honeypot is a modified version of the OpenSSH daemon designed to detect and log SSH-based attacks. It forwards all attacker commands to Cowrie, a honeypot backend, which interprets the commands and returns responses, enabling detailed logging of brute force attempts and shell interactions. Because it uses the genuine OpenSSH codebase, it avoids fingerprinting based on protocol deviations or error message differences, making it a stealthy detection tool.
The project aims to create a high-interaction honeypot that mimics real SSH servers as closely as possible, using OpenSSH to improve stealth and effectiveness in capturing attacker behavior.
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.