Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Improve nc command realism and add abuse protection#2815

Merged
micheloosterhof merged 32 commits intocowrie:mainfrom
filippolauria:main
Dec 1, 2025
Merged

Improve nc command realism and add abuse protection#2815
micheloosterhof merged 32 commits intocowrie:mainfrom
filippolauria:main

Conversation

@filippolauria
Copy link
Contributor

Enhance the nc (netcat) honeypot command to be less detectable and prevent abuse.

Changes

Improve realism

  • Fix command hang caused by yield
  • Update usage text and help output to match real netcat-openbsd
  • Add flag handling: -h, -l, -p, -u, -z, -v, -6
  • Add realistic error messages for unsupported modes
  • Add socket timeout to prevent indefinite blocking
  • Add port validation utility

Abuse prevention

filippolauria and others added 30 commits November 17, 2025 08:58
Modify wget command to use the new RateLimiter class to prevent attackers
from abusing the honeypot to launch DDoS attacks against external targets.

Changes:
- Import and initialize RateLimiter with wget-specific configuration
- Add rate limit check before processing any download request
- Simulate realistic connection timeout when rate limit is exceeded
- Use configurable parameters from CowrieConfig with sensible defaults:
  * wget_rate_limit_enabled (default: true)
  * wget_rate_limit_requests (default: 5)
  * wget_rate_limit_window (default: 60 seconds)
  * wget_rate_limit_max_hosts (default: 1000)

When rate limited, the command now shows a connection timeout error
indistinguishable from a real network failure, preventing attackers
from detecting the rate limiting mechanism.

Note: cowrie.cfg has not been modified in this commit. The rate limiter
will use the default values until explicit configuration is added.
The feature can be disabled by setting wget_rate_limit_enabled=false
in the configuration file.

This change maintains full backward compatibility while adding protection
against abuse.
…or()

- Align usage output with real netcat-openbsd
- Method name better reflects its purpose (uniform with wget command)
- Distinguish between invalid option and missing argument errors
- Match real nc error output format
Listen mode not implemented, but errors match real nc behavior.
Non-blocking connect not implemented, use timeout as workaround.
Show success/failure messages matching real nc output format.
@micheloosterhof micheloosterhof merged commit 34b7215 into cowrie:main Dec 1, 2025
16 of 18 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants