SSH Honeypots

Honeypots for SSH!

At some point the c-Champions will need to provide technical resources to the network engineers and stakeholder managers. This section of the Toolkit provides a listing of various cyber threat hunting tools for the technical analysts within stakeholder organizations. Below are a series of hotlinks and short descriptions of honeypots for monitoring the SSH protocol.

https://github.com/desaster/kippo-“Kippo is a medium interaction SSH honeypot designed to log brute force attacks and, most importantly, the entire shell interaction performed by the attacker.”(Desaster. (2017) desaster/kippo: Kippo – SSH Honeypot. Retrieved April 22, 2017, from https://github.com/desaster/kippo)

https://github.com/micheloosterhof/cowrie-“Cowrie is a medium interaction SSH and Telnet honeypot designed to log brute force attacks and the shell interaction performed by the attacker.”(Micheloosterhof. (2017) micheloosterhof/cowrie: Cowrie SSH/Telnet Honeypot. Retrieved April 22, 2017, from https://github.com/micheloosterhof/cowrie)

https://github.com/magisterquis/sshlowpot-(Magisterquis. (2017) magisterquis/sshlowpot: Yet another no-frills low-interaction ssh honeypot in Go. Retrieved April 22, 2017, from https://github.com/magisterquis/sshlowpot)

https://github.com/magisterquis/sshhipot-(Magisterquis. (2017) magisterquis/sshhipot: High-interaction MitM SSH honeypot. Retrieved April 22, 2017, from https://github.com/magisterquis/sshhipot)

https://github.com/xme/dshield-docker-(Xme. (2017) xme/dshield-docker: Docker container running cowrie with DShield output enabled. Retrieved April 22, 2017, from https://github.com/xme/dshield-docker)

https://github.com/czardoz/hornet-“Hornet is aimed to be a medium interaction SSH Honeypot, that supports multiple virtual hosts.”(Czardoz. (2017) czardoz/hornet: SSH Multipot. Retrieved April 22, 2017, from https://github.com/czardoz/hornet)

https://github.com/droberson/ssh-honeypot-(Droberson. (2017) droberson/ssh-honeypot: Fake sshd that logs ip addresses, usernames, and passwords. Retrieved April 22, 2017, from https://github.com/droberson/ssh-honeypot)

https://github.com/madirish/kojoney2-(Madirish. (2017) madirish/kojoney2: Kojoney2 is a low interaction SSH honeypot written in Python. Based on Kojoney by Jose Antonio Coret. Retrieved April 22, 2017, from https://github.com/madirish/kojoney2)