Improve nc command realism and add abuse protection#2815
Merged
micheloosterhof merged 32 commits intocowrie:mainfrom Dec 1, 2025
Merged
Improve nc command realism and add abuse protection#2815micheloosterhof merged 32 commits intocowrie:mainfrom
micheloosterhof merged 32 commits intocowrie:mainfrom
Conversation
Modify wget command to use the new RateLimiter class to prevent attackers from abusing the honeypot to launch DDoS attacks against external targets. Changes: - Import and initialize RateLimiter with wget-specific configuration - Add rate limit check before processing any download request - Simulate realistic connection timeout when rate limit is exceeded - Use configurable parameters from CowrieConfig with sensible defaults: * wget_rate_limit_enabled (default: true) * wget_rate_limit_requests (default: 5) * wget_rate_limit_window (default: 60 seconds) * wget_rate_limit_max_hosts (default: 1000) When rate limited, the command now shows a connection timeout error indistinguishable from a real network failure, preventing attackers from detecting the rate limiting mechanism. Note: cowrie.cfg has not been modified in this commit. The rate limiter will use the default values until explicit configuration is added. The feature can be disabled by setting wget_rate_limit_enabled=false in the configuration file. This change maintains full backward compatibility while adding protection against abuse.
…or() - Align usage output with real netcat-openbsd - Method name better reflects its purpose (uniform with wget command)
- Distinguish between invalid option and missing argument errors - Match real nc error output format
Listen mode not implemented, but errors match real nc behavior.
Non-blocking connect not implemented, use timeout as workaround.
Show success/failure messages matching real nc output format.
Prevent honeypot abuse for attacking external targets.
…lint false positive
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Enhance the
nc(netcat) honeypot command to be less detectable and prevent abuse.Changes
Improve realism
-h,-l,-p,-u,-z,-v,-6Abuse prevention
RateLimiterfrom Add rate limiting to prevent DDoS abuse and improve wget command #2800)