FakeServer class. @ivar hostname Servers Host Name @ivar fs File System for cowrie to use

FakeAvatar class. @var avatar itself @ivar server server configuration @var fs File System for cowrie to use @var environ for user

Fake transport with abortConnection() method.

A bash-style syntax error to report verbatim. TODO: the trailing underscore avoids shadowing the builtin SyntaxError. Consider renaming to Pa

Parse a command line into a list of statements for the shell to run.

This class is placeholder for creating a fake interface. @var host Client fake information @var port Fake Port for connection @var otherV

CowrieTelnetTransport

Mock HTTP response for testing

Minimal ShellContext: fixed variables and a recording substitution.

TelnetAuthProtocol that takes care of Authentication. Once authenticated this protocol is replaced with HoneyPotTelnetSession.

Checker that accepts "keyboard-interactive" and "password"

Adapt a terminal protocol so the SSH session can drive it as its process transport, firing the protocol's connectionLost exactly once. The se

An internal queue entry that runs a Python callback when reached. Flow control schedules these between the statements it splices into ``cmdpe

A malformed test expression; ``test`` reports it and exits 2. Message templates live here so the call sites raise with a short tag, keeping t

A simple command / pipeline, structure only. ``items`` keeps the ordered word trees (still unevaluated) interleaved with the control operator

Client for communicating with OpenAI-compatible LLM APIs.

Mock for Twisted's _OptionState.

Rate limiter to prevent attackers from abusing Cowrie to launch DDoS attacks. Prevents abuse where malicious actors attempt to use Cowrie co

Handles parsing of shell commands, including tokenization, redirection, and variable expansion.

Stand-in for LoggingServerProtocol that counts connectionLost calls.

Mock TFTP server for testing

virustotal output

This class represents the transport layer from Cowrie's proxy to the backend SSH server. It is responsible for authentication to that server,

A ``{ ...; }`` command group: its statements run in the current shell.

``case WORD in PATTERN[|PATTERN]) BODY ;; ... esac``. ``word`` is a :class:`Command` carrying the (unevaluated) word to match; ``items`` pair

Underlying TCP transport stub that records bytes written.

Overload original Twisted with improved date formatting

SFTPTFile

This factory creates HoneyPotSSHTransport instances They listen directly to the TCP port

Minimal application protocol that only agrees to echo locally.

ConfigParser with additional option to read from environment variables # TODO: def sections()

Protocol to receive FTP file data

This channel does not forward, but just logs requests.

A non-root avatar for testing password prompts.

Minimal transport capturing bytes written to it.

``for VAR in WORDS; do BODY; done``. ``items`` is a :class:`Command` whose words are the (unevaluated) ``in`` list, expanded against the live

``name() { BODY; }`` -- registers ``name`` for later invocation.

This class contains code to handle the groups and their properties in /etc/group.

Class for keeping track of QEMU guests.

Checker that accepts, logs and denies public key authentication attempts

``if COND; then BODY; [elif COND; then BODY;]* [else BODY;] fi``. ``branches`` pairs each condition statement-list with its body; ``else_body``

Dictionary class with methods for cleaning and dumping its state. This class should be treated as global state. For the moment this is a

This service provides a NAT-like service when the backend pool is located in a remote machine. Guests are bound to a local IP (e.g., 192

no VM's available

Signal messenger output plugin.

This class contains code to handle the users and their properties in /etc/passwd. Note that contrary to the name, it does not handle any

Represents the connection between a protocol instance (SSH or Telnet) and a QEMU pool

When the PoolHandler is started, it establishes a "master" connection to the pool server. After that connection is successful (initial_pool_c

Main PoolServer

Factory for PoolServer

VM States: created -> available -> using -> used -> unavailable -> destroyed created: initialised but not fully booted by QE

Reconnecting adbapi connection pool for MySQL. This class improves on the solution posted at http://www.gelens.org/2008/09/12/reinitiali

Reconnecting adbapi connection pool for PostgreSQL. This handles reconnections on known transient errors like server disconnects or deadlock

HTTP client and methods for preparing report paramaters.

This class modifies the original to close the connection

Collects the response body from an HTTP response.

Feeds a request body to the HTTP client.

A ``(...)`` group, holding its parsed (still unevaluated) inner statements. Cowrie does not emulate a subshell's isolated environment, so the cal

This class modifies the original to perform TCP tunneling via the CONNECT method

Async TFTP client using Twisted's DatagramProtocol Implements RFC 1350 TFTP protocol

Both an IProcessProtocol and an ITransport. Transport to the remote endpoint and process protocol to the local subsystem.

I am both an L{IProcessProtocol} and an L{ITransport}. I am a transport to the remote endpoint and a process protocol to the local subsys

This credential interface also provides an IP address

``while COND; do BODY; done`` (or ``until`` when ``until`` is True).