Home / cowrie / cowrie
AI Slop Code RIsk Monitor

cowrie/cowrie

Cowrie SSH/Telnet Honeypot https://docs.cowrie.org/

36.8 High pattern signal View on GitHub

Maintenance and Governance Review

This report summarizes scanner evidence for cowrie/cowrie, a Python project with 6,595 GitHub stars. SynthScan examined 66,798 lines of code across 398 source files, recording 1722 pattern matches distributed across 16 syntactic categories. The legacy adjusted pattern signal is 36.8 (High pattern signal); it is not an authorship estimate.

Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.

36.8
Adjusted Signal
36.8
Raw Pattern Score
100%
Time Factor
2026-10-07
Last Push
6.6K
Stars
Python
Language
66.8K
Lines of Code
398
Files
1.7K
Pattern Hits
2026-10-12
Scan Date
0.24
HC Hit Rate

Risk Review · v3

Use each vector to guide manual verification of the underlying findings.

Cognitive Ownership Risk 65.9/100 · HIGH

Can maintainers explain intent, assumptions, and trade-offs? 1195 finding(s).

Hallucinated Dependency & Supply Chain Risk 39.7/100 · MEDIUM

Are imports declared and package/API names verified? 370 finding(s).

Agent Over-Engineering Ratio 69.2/100 · HIGH

Are wrappers, guards, and repeated structures necessary? 1178 finding(s).

PR Review Velocity Impact 81.5/100 · CRITICAL

Which changes need focused human review? 1722 finding(s).

What These Metrics Mean

Adjusted Signal
Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score
Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor
A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits
Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate
High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files
Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 2HIGH 92MEDIUM 28LOW 1600

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 1722 distinct pattern matches across 16 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Hyper-Verbose Identifiers1020 hits · 1226 pts
SeverityFileLineSnippetContext
LOW⚡.github/scripts/advanced-honeypot-tests.py172 def test_filesystem_consistency(self, client: paramiko.SSHClient) -> bool:CODE
LOWsrc/cowrie/llm/protocol.py255 def _process_command_with_llm(self, command: str) -> None:CODE
LOWsrc/cowrie/core/utils.py162def get_endpoints_from_section(CODE
LOWsrc/cowrie/test/test_telegram.py43 def test_redirect_in_command_is_escaped(self) -> None:CODE
LOWsrc/cowrie/test/test_telegram.py53 def test_markup_in_command_is_not_rendered(self) -> None:CODE
LOWsrc/cowrie/test/test_telegram.py68 def test_ampersand_in_command_is_escaped(self) -> None:CODE
LOWsrc/cowrie/test/test_telegram.py75 def test_credentials_are_escaped(self) -> None:CODE
LOWsrc/cowrie/test/test_telegram.py89 def test_download_url_is_escaped(self) -> None:CODE
LOWsrc/cowrie/test/test_telegram.py101 def test_wrapping_tags_survive(self) -> None:CODE
LOWsrc/cowrie/test/test_parser.py51 def test_stderr_to_devnull_inline(self) -> None:CODE
LOWsrc/cowrie/test/test_parser.py73 def test_multiple_redirections(self) -> None:CODE
LOWsrc/cowrie/test/test_parser.py87 def test_redirect_without_target(self) -> None:CODE
LOWsrc/cowrie/test/test_parser.py121 def test_redirect_both_stdout_stderr(self) -> None:CODE
LOWsrc/cowrie/test/test_parser.py133 def test_redirect_both_append(self) -> None:CODE
LOWsrc/cowrie/test/test_parser.py139 def test_redirect_both_inline_target(self) -> None:CODE
LOWsrc/cowrie/test/test_sed.py49 def test_substitute_groups_and_ampersand(self) -> None:CODE
LOWsrc/cowrie/test/test_sed.py63 def test_bracket_classes_and_anchors(self) -> None:CODE
LOWsrc/cowrie/test/test_sed.py75 def test_print_and_delete_with_addresses(self) -> None:CODE
LOW⚡src/cowrie/test/test_sed.py86 def test_quit_and_line_number(self) -> None:CODE
LOW⚡src/cowrie/test/test_sed.py96 def test_append_insert_change(self) -> None:CODE
LOW⚡src/cowrie/test/test_sed.py102 def test_multiple_expressions_and_blocks(self) -> None:CODE
LOW⚡src/cowrie/test/test_sed.py115 def test_labels_and_branches_join_lines(self) -> None:CODE
LOW⚡src/cowrie/test/test_sed.py121 def test_print_only_substituted_lines(self) -> None:CODE
LOW⚡src/cowrie/test/test_sed.py127 def test_delete_first_line_of_pattern_space_restarts_cycle(self) -> None:CODE
LOWsrc/cowrie/test/test_sed.py160 def test_unterminated_substitute(self) -> None:CODE
LOWsrc/cowrie/test/test_sed.py172 def test_no_script_prints_usage(self) -> None:CODE
LOWsrc/cowrie/test/test_sed.py189 def test_option_values_are_not_mistaken_for_i(self) -> None:CODE
LOW⚡src/cowrie/test/test_resources.py18 def test_returns_bytes_for_existing_resource(self) -> None:CODE
LOW⚡src/cowrie/test/test_resources.py23 def test_raises_file_not_found_for_missing_resource(self) -> None:CODE
LOW⚡src/cowrie/test/test_resources.py27 def test_raises_file_not_found_for_missing_subpath(self) -> None:CODE
LOW⚡src/cowrie/test/test_resources.py31 def test_raises_file_not_found_for_directory(self) -> None:CODE
LOW⚡src/cowrie/test/test_resources.py39 def test_raises_file_not_found_for_directory_via_empty_subpath(self) -> None:CODE
LOW⚡src/cowrie/test/test_resources.py49 def test_yields_readable_binary_stream(self) -> None:CODE
LOW⚡src/cowrie/test/test_resources.py55 def test_raises_file_not_found_for_missing_resource(self) -> None:CODE
LOW⚡src/cowrie/test/test_resources.py60 def test_raises_file_not_found_for_directory(self) -> None:CODE
LOWsrc/cowrie/test/test_reversedns.py72 def test_second_connect_same_ip_dispatches_again(self) -> None:CODE
LOWsrc/cowrie/test/test_reversedns.py83 def test_forward_after_connect_same_ip_dispatches(self) -> None:CODE
LOW⚡src/cowrie/test/test_reversedns.py100 def test_timeout_is_not_cached(self) -> None:CODE
LOW⚡src/cowrie/test/test_reversedns.py106 def test_servfail_is_not_cached(self) -> None:CODE
LOW⚡src/cowrie/test/test_reversedns.py112 def test_invalid_ip_does_no_lookup(self) -> None:CODE
LOW⚡src/cowrie/test/test_shell_cwd.py36 def test_top_level_cd_persists(self) -> None:CODE
LOW⚡src/cowrie/test/test_shell_cwd.py40 def test_substitution_sees_its_own_cd(self) -> None:CODE
LOW⚡src/cowrie/test/test_shell_cwd.py44 def test_substitution_cd_does_not_leak(self) -> None:CODE
LOW⚡src/cowrie/test/test_shell_cwd.py48 def test_substitution_inherits_parent_cwd(self) -> None:CODE
LOW⚡src/cowrie/test/test_shell_cwd.py54 def test_nested_sh_cd_does_not_leak(self) -> None:CODE
LOW⚡src/cowrie/test/test_shell_cwd.py58 def test_relative_path_resolves_against_shell_cwd(self) -> None:CODE
LOWsrc/cowrie/test/test_telnet_proxy_handler.py71 def test_username_with_cr_nul(self) -> None:CODE
LOWsrc/cowrie/test/test_telnet_proxy_handler.py76 def test_username_with_bare_trailing_cr(self) -> None:CODE
LOWsrc/cowrie/test/test_telnet_proxy_handler.py90 def test_password_with_bare_trailing_cr(self) -> None:CODE
LOWsrc/cowrie/test/test_telnet_proxy_handler.py96 def test_valid_password_forwards_the_backend_password(self) -> None:CODE
LOWsrc/cowrie/test/test_jsonlog.py35 def test_rotation_never_splits_an_event(self) -> None:CODE
LOWsrc/cowrie/test/test_curl.py55 def test_malformed_port_does_not_hang(self) -> None:CODE
LOWsrc/cowrie/test/test_curl.py66 def test_out_of_range_port_does_not_hang(self) -> None:CODE
LOWsrc/cowrie/test/test_curl.py75 def test_failed_download_removes_temp_artifact(self) -> None:CODE
LOWsrc/cowrie/test/test_curl.py98 def test_tcp_timeout_reports_connection_timed_out(self) -> None:CODE
LOWsrc/cowrie/test/test_curl.py119 def test_missing_host_reports_error_without_crashing(self) -> None:CODE
LOWsrc/cowrie/test/test_curl.py127 def test_exit_removes_empty_artifact(self) -> None:CODE
LOWsrc/cowrie/test/test_curl.py143 def test_artifact_close_is_idempotent(self) -> None:CODE
LOWsrc/cowrie/test/test_curl.py172 def test_late_download_callbacks_after_exit_are_inert(self) -> None:CODE
LOW⚡src/cowrie/test/test_curl.py238 def test_get_binds_agent_to_out_addr(self) -> None:CODE
960 more matches not shown…
Cross-Language Confusion50 hits · 342 pts
SeverityFileLineSnippetContext
HIGH⚡.github/scripts/advanced-honeypot-tests.py180 stdin, stdout, stderr = client.exec_command('ls -la /bin/bash /bin/sh /usr/bin/python* 2>/dev/null || echo "CODE
HIGH⚡.github/scripts/advanced-honeypot-tests.py205 stdin, stdout, stderr = client.exec_command('netstat -an 2>/dev/null || ss -an')CODE
HIGH⚡.github/scripts/advanced-honeypot-tests.py214 stdin, stdout, stderr = client.exec_command('ip addr || ifconfig')CODE
HIGHsrc/cowrie/test/test_cat.py44 (b"cat /etc/hostname > /dev/null; echo $?", b"0\n"),CODE
HIGHsrc/cowrie/test/test_cat.py51 b"cat nonExisting /etc/hostname > /dev/null; echo $?",CODE
HIGH⚡src/cowrie/test/test_bashparse.py219 statements = self.parser.parse("a && b || c")CODE
HIGH⚡src/cowrie/test/test_bashparse.py219 statements = self.parser.parse("a && b || c")CODE
HIGH⚡src/cowrie/test/test_bashparse.py268 statements = self.parser.parse("true && echo a | cat")CODE
HIGH⚡src/cowrie/test/test_bashparse.py547 statements = self.parser.parse("true && for i in 1; do echo $i; done")CODE
HIGH⚡src/cowrie/test/test_bashparse.py625 self._assert_unambiguous("echo a > f 2>&1 && echo b || echo c & # done\n")CODE
HIGH⚡src/cowrie/test/test_bashparse.py625 self._assert_unambiguous("echo a > f 2>&1 && echo b || echo c & # done\n")CODE
HIGH⚡src/cowrie/test/test_test_builtin.py54 self.proto.lineReceived(b"true && echo yes")CODE
HIGH⚡src/cowrie/test/test_test_builtin.py59 self.proto.lineReceived(b"false || echo recovered")CODE
HIGH⚡src/cowrie/test/test_exec_builtin.py71 self.assertEqual(self.run_line(b"exec 2>/dev/null; echo $?"), b"0\n")CODE
HIGH⚡src/cowrie/test/test_grep.py123 (b"grep -q root /nonexistent /etc/passwd 2>/dev/null; echo $?", b"0\n"),CODE
HIGH⚡src/cowrie/test/test_grep.py124 (b"grep -q zzz /nonexistent /etc/passwd 2>/dev/null; echo $?", b"2\n"),CODE
HIGH⚡src/cowrie/test/test_script_execution.py202 b"printf 'for u in a b c\\ndo\\necho fetch $u && break\\ndone\\n'"CODE
HIGHsrc/cowrie/test/test_script_execution.py106 """Scripts test `cmd || fallback`; a binary that cannot run mustSTRING
HIGH⚡src/cowrie/test/test_tr.py103 b"printf 'x\\ny\\n' | ( tr -d '\\n' 2>/dev/null || cat ); echo"CODE
HIGHsrc/cowrie/test/test_flow_control.py237 "for url in http://a/x http://b/x; do echo fetch $url && break; done"CODE
HIGH⚡src/cowrie/test/test_exit_status.py60 self.assertEqual(self.run_line(b"true && echo ran"), b"ran\n")CODE
HIGH⚡src/cowrie/test/test_exit_status.py61 self.assertEqual(self.run_line(b"false && echo ran"), b"")CODE
HIGH⚡src/cowrie/test/test_exit_status.py64 self.assertEqual(self.run_line(b"false || echo ran"), b"ran\n")CODE
HIGH⚡src/cowrie/test/test_exit_status.py65 self.assertEqual(self.run_line(b"true || echo ran"), b"")CODE
HIGH⚡src/cowrie/test/test_exit_status.py69 self.assertEqual(self.run_line(b"false && echo a || echo b"), b"b\n")CODE
HIGH⚡src/cowrie/test/test_exit_status.py69 self.assertEqual(self.run_line(b"false && echo a || echo b"), b"b\n")CODE
HIGH⚡src/cowrie/test/test_exit_status.py71 self.assertEqual(self.run_line(b"true && echo a || echo b"), b"a\n")CODE
HIGH⚡src/cowrie/test/test_exit_status.py71 self.assertEqual(self.run_line(b"true && echo a || echo b"), b"a\n")CODE
HIGH⚡src/cowrie/test/test_exit_status.py75 self.assertEqual(self.run_line(b"false && echo x; echo $?"), b"1\n")CODE
HIGH⚡src/cowrie/test/test_exit_status.py90 self.assertEqual(self.run_line(b"bash -c false && echo ran"), b"")CODE
HIGH⚡src/cowrie/test/test_exit_status.py97 out = self.run_line(b"dd if=/nonexistentfile && echo ran")CODE
HIGH⚡src/cowrie/test/test_exit_status.py145 self.assertEqual(self.run_line(b"echo $(true || echo x)"), b"\n")CODE
HIGH⚡src/cowrie/test/test_exit_status.py146 self.assertEqual(self.run_line(b"echo $(false || echo y)"), b"y\n")CODE
HIGH⚡src/cowrie/test/test_echo.py177 self.proto.lineReceived(b"(echo first && echo second)")CODE
HIGH⚡src/cowrie/test/test_echo.py185 self.proto.lineReceived(b"(echo first || echo second)")CODE
HIGH⚡src/cowrie/test/test_echo.py253 self.proto.lineReceived(b"( ./xxxxxx 2>&1 || true ) | wc -c\n")CODE
HIGH⚡src/cowrie/test/test_echo.py257 self.proto.lineReceived(b"( xxxxxx ) 2>/dev/null; echo rc=$?\n")CODE
HIGH⚡src/cowrie/test/test_echo.py279 self.proto.lineReceived(b"bash -c 'echo (' 2>/dev/null; echo rc=$?\n")CODE
HIGH⚡src/cowrie/test/test_async_substitution.py95 self.proto.lineReceived(b"echo $(fakeasync && echo ok)\n")CODE
HIGH⚡src/cowrie/test/test_async_substitution.py101 self.proto.lineReceived(b"echo $(fakeasync && echo ok)\n")CODE
HIGH⚡src/cowrie/test/test_pipeline.py79 self.run_line("false || echo a | cat && echo b"), b"a\nb\n" + PROMPTCODE
HIGH⚡src/cowrie/test/test_pipeline.py79 self.run_line("false || echo a | cat && echo b"), b"a\nb\n" + PROMPTCODE
HIGHsrc/cowrie/shell/parser.py6# ABOUTME: Handles FD redirections like 2>/dev/null, stdin redirects, and command substitution.COMMENT
HIGHsrc/cowrie/shell/honeypot.py378 A subshell is queued as one unit so its join operator (e.g. the || inSTRING
HIGHsrc/cowrie/commands/fs.py77 self.writeBytes(b"\t[--null] [pattern] [file ...]\n")CODE
HIGHsrc/cowrie/commands/ftpget.py232 self.write("ftpget: cmd (null) (null)\n")CODE
HIGHsrc/cowrie/commands/ftpget.py253 self.write("ftpget: cmd TYPE I (null)\n")CODE
HIGHsrc/cowrie/commands/ftpget.py254 self.write("ftpget: cmd PASV (null)\n")CODE
HIGHsrc/cowrie/commands/ftpget.py278 self.write("ftpget: cmd (null) (null)\n")CODE
HIGHsrc/cowrie/commands/ftpget.py279 self.write("ftpget: cmd QUIT (null)\n")CODE
Unused Imports318 hits · 312 pts
SeverityFileLineSnippetContext
LOW.github/scripts/advanced-honeypot-tests.py12CODE
LOW.github/scripts/advanced-honeypot-tests.py14CODE
LOW.github/scripts/advanced-honeypot-tests.py15CODE
LOWsrc/cowrie/llm/telnet.py9CODE
LOWsrc/cowrie/llm/server.py6CODE
LOWsrc/cowrie/llm/protocol.py6CODE
LOWsrc/cowrie/llm/session.py5CODE
LOWsrc/cowrie/llm/llm.py8CODE
LOWsrc/cowrie/llm/llm.py34CODE
LOWsrc/cowrie/llm/avatar.py6CODE
LOWsrc/cowrie/llm/realm.py5CODE
LOWsrc/cowrie/core/auth.py10CODE
LOWsrc/cowrie/core/config.py10CODE
LOWsrc/cowrie/core/artifact.py25CODE
LOWsrc/cowrie/core/checkers.py10CODE
LOWsrc/cowrie/core/credentials.py5CODE
LOWsrc/cowrie/core/cef.py10CODE
LOWsrc/cowrie/core/fingerprint.py22CODE
LOWsrc/cowrie/core/events.py16CODE
LOWsrc/cowrie/core/download.py8CODE
LOWsrc/cowrie/core/ocsf.py21CODE
LOWsrc/cowrie/core/ttylog.py11CODE
LOWsrc/cowrie/core/eventids.py25CODE
LOWsrc/cowrie/core/utils.py6CODE
LOWsrc/cowrie/core/network.py20CODE
LOWsrc/cowrie/core/resources.py8CODE
LOWsrc/cowrie/core/uuid.py6CODE
LOWsrc/cowrie/core/output.py5CODE
LOWsrc/cowrie/test/test_telegram.py8CODE
LOWsrc/cowrie/test/test_parser.py8CODE
LOWsrc/cowrie/test/fake_server.py6CODE
LOWsrc/cowrie/test/test_command.py8CODE
LOWsrc/cowrie/test/test_sed.py8CODE
LOWsrc/cowrie/test/test_resources.py8CODE
LOWsrc/cowrie/test/test_reversedns.py8CODE
LOWsrc/cowrie/test/test_cat.py5CODE
LOWsrc/cowrie/test/test_shell_cwd.py8CODE
LOWsrc/cowrie/test/test_telnet_proxy_handler.py8CODE
LOWsrc/cowrie/test/test_jsonlog.py8CODE
LOWsrc/cowrie/test/test_curl.py8CODE
LOWsrc/cowrie/test/test_protocol_keystroke.py6CODE
LOWsrc/cowrie/test/test_pool_config.py8CODE
LOWsrc/cowrie/test/test_greynoise.py8CODE
LOWsrc/cowrie/test/test_utils.py5CODE
LOWsrc/cowrie/test/test_download.py8CODE
LOWsrc/cowrie/test/test_cut.py4CODE
LOWsrc/cowrie/test/fake_transport.py6CODE
LOWsrc/cowrie/test/test_exec_shell_stdin.py8CODE
LOWsrc/cowrie/test/test_output_socketlog.py8CODE
LOWsrc/cowrie/test/test_proxy_packet_buffer.py8CODE
LOWsrc/cowrie/test/test_kafka.py8CODE
LOWsrc/cowrie/test/test_insults_events.py8CODE
LOWsrc/cowrie/test/test_output_lifecycle.py8CODE
LOWsrc/cowrie/test/test_session_duration.py8CODE
LOWsrc/cowrie/test/test_ftpget.py5CODE
LOWsrc/cowrie/test/test_ftpget.py41CODE
LOWsrc/cowrie/test/test_llm.py8CODE
LOWsrc/cowrie/test/test_awk.py4CODE
LOWsrc/cowrie/test/test_output_sql_parity.py8CODE
LOWsrc/cowrie/test/test_output_sql_parity.py29CODE
258 more matches not shown…
Excessive Try-Catch Wrapping102 hits · 114 pts
SeverityFileLineSnippetContext
LOW⚡.github/scripts/advanced-honeypot-tests.py167 except Exception as e:CODE
LOW⚡.github/scripts/advanced-honeypot-tests.py218 except Exception as e:CODE
LOW.github/scripts/advanced-honeypot-tests.py62 except Exception as e:CODE
LOW.github/scripts/advanced-honeypot-tests.py88 except Exception as e:CODE
LOW.github/scripts/advanced-honeypot-tests.py112 except Exception as e:CODE
LOW.github/scripts/advanced-honeypot-tests.py139 except Exception as e:CODE
LOW.github/scripts/advanced-honeypot-tests.py192 except Exception as e:CODE
LOW.github/scripts/advanced-honeypot-tests.py258 except Exception as e:CODE
LOWsrc/cowrie/llm/telnet.py76 except Exception:CODE
LOWsrc/cowrie/llm/protocol.py159 except Exception:CODE
LOWsrc/cowrie/core/auth.py185 except Exception:CODE
LOWsrc/cowrie/core/fingerprint.py153 except Exception as e:CODE
LOWsrc/cowrie/core/fingerprint.py227 except Exception as e:CODE
LOWsrc/cowrie/core/events.py124 except Exception as e: # one sink must not stop the restCODE
LOWsrc/cowrie/core/network.py171 except Exception as e:CODE
LOWsrc/cowrie/core/output.py142 except Exception:CODE
LOWsrc/cowrie/shell/protocol.py132 except Exception:CODE
LOWsrc/cowrie/shell/protocol.py147 except Exception:CODE
LOWsrc/cowrie/shell/protocol.py499 except Exception:CODE
MEDIUMsrc/cowrie/shell/protocol.py496def displayMOTD(self) -> None:CODE
LOWsrc/cowrie/shell/pwd.py39 except Exception:CODE
LOWsrc/cowrie/shell/pwd.py153 except Exception:CODE
LOWsrc/cowrie/shell/fs.py131 except Exception:CODE
LOWsrc/cowrie/shell/fs.py159 except Exception as e:CODE
LOWsrc/cowrie/shell/fs.py429 except Exception:CODE
LOWsrc/cowrie/shell/fs.py444 except Exception:CODE
LOWsrc/cowrie/shell/fs.py461 except Exception:CODE
LOWsrc/cowrie/shell/pipe.py280 except Exception:CODE
LOWsrc/cowrie/shell/honeypot.py1183 except Exception:CODE
LOWsrc/cowrie/output/postgresql.py76 except Exception as e:CODE
MEDIUMsrc/cowrie/output/postgresql.py26def _runInteraction(self, interaction, *args, **kw):CODE
LOWsrc/cowrie/output/dshield.py215 except Exception as e:CODE
LOWsrc/cowrie/output/cuckoo.py117 except Exception as e:CODE
LOWsrc/cowrie/output/cuckoo.py146 except Exception as e:CODE
LOWsrc/cowrie/output/cuckoo.py173 except Exception as e:CODE
LOWsrc/cowrie/output/abuseipdb.py392 except Exception as e:CODE
LOWsrc/cowrie/output/abuseipdb.py408 except Exception:CODE
MEDIUMsrc/cowrie/output/abuseipdb.py383def http_request(self, params):CODE
LOWsrc/cowrie/output/rethinkdblog.py101 except Exception:CODE
LOWsrc/cowrie/output/influx.py52 except Exception:CODE
LOWsrc/cowrie/output/discord.py123 except Exception:CODE
LOW⚡src/cowrie/output/discord.py207 except Exception:CODE
LOW⚡src/cowrie/output/discord.py212 except Exception:CODE
LOW⚡src/cowrie/output/discord.py216 except Exception:CODE
LOWsrc/cowrie/output/misp.py307 except Exception as e:CODE
LOWsrc/cowrie/output/prometheus.py149 except Exception as e:CODE
LOWsrc/cowrie/output/kafka.py105 except Exception as e:CODE
LOWsrc/cowrie/output/kafka.py137 except Exception as e:CODE
LOWsrc/cowrie/output/kafka.py176 except Exception as e:CODE
LOWsrc/cowrie/output/axiom.py68 except Exception as e:CODE
LOWsrc/cowrie/output/malshare.py86 except Exception as e:CODE
LOWsrc/cowrie/output/oraclecloud.py71 except Exception as ex:CODE
LOWsrc/cowrie/output/mysql.py90 except Exception as e:CODE
MEDIUMsrc/cowrie/output/mysql.py41def _runInteraction(self, interaction, *args, **kw):CODE
LOWsrc/cowrie/ssh_proxy/protocols/port_forward.py54 except Exception as e:CODE
LOWsrc/cowrie/ssh_proxy/protocols/port_forward.py83 except Exception as e:CODE
LOWsrc/cowrie/ssh/forwarding.py156 except Exception as e:CODE
LOWsrc/cowrie/ssh/forwarding.py184 except Exception as e:CODE
LOWsrc/cowrie/ssh/forwarding.py251 except Exception as e:CODE
LOWsrc/cowrie/ssh/forwarding.py281 except Exception as e:CODE
42 more matches not shown…
Empty Error Handlers22 hits · 110 pts
SeverityFileLineSnippetContext
HIGHsrc/cowrie/core/artifact.py94except FileNotFoundError:CODE
HIGHsrc/cowrie/core/uuid.py52except FileNotFoundError:CODE
HIGHsrc/cowrie/test/fake_transport.py133except KeyError:CODE
HIGHsrc/cowrie/shell/protocol.py257except FileNotFoundError:CODE
HIGHsrc/cowrie/shell/protocol.py499except Exception:CODE
HIGHsrc/cowrie/output/abuseipdb.py107except UnboundLocalError:CODE
HIGHsrc/cowrie/output/abuseipdb.py265except AttributeError:CODE
HIGHsrc/cowrie/output/rethinkdblog.py96except ReqlOpFailedError:CODE
HIGHsrc/cowrie/ssh_proxy/server_transport.py404except AttributeError:CODE
HIGHsrc/cowrie/ssh/factory.py93except OSError:CODE
HIGHsrc/cowrie/scripts/createdynamicprocess.py37except psutil.NoSuchProcess:CODE
HIGHsrc/cowrie/commands/sed.py746except fs.FileNotFound:CODE
HIGHsrc/cowrie/commands/printf.py117except _Stop:CODE
HIGHsrc/cowrie/commands/free.py114except Exception:CODE
HIGHsrc/cowrie/commands/ftpget.py130except ValueError:CODE
HIGHsrc/cowrie/commands/tftp.py456except Exception: # pylint: disable=broad-exception-caughtCODE
HIGHsrc/cowrie/commands/tftp.py531except ValueError:CODE
HIGHsrc/cowrie/commands/base.py930except Exception:CODE
HIGHsrc/cowrie/commands/wget.py219except Exception:CODE
HIGHsrc/cowrie/insults/insults.py242except OSError:CODE
HIGHsrc/backend_pool/libvirt/backend_service.py171except KeyboardInterrupt:CODE
HIGHsrc/backend_pool/libvirt/snapshot_handler.py16except PermissionError:CODE
Deep Nesting101 hits · 101 pts
SeverityFileLineSnippetContext
LOWsrc/cowrie/core/auth.py197CODE
LOWsrc/cowrie/core/fingerprint.py39CODE
LOWsrc/cowrie/core/fingerprint.py167CODE
LOWsrc/cowrie/core/network.py133CODE
LOWsrc/cowrie/test/test_output_mongodb.py91CODE
LOWsrc/cowrie/test/test_output_rmq.py99CODE
LOWsrc/cowrie/shell/protocol.py407CODE
LOWsrc/cowrie/shell/bashparse.py640CODE
LOWsrc/cowrie/shell/bashparse.py1102CODE
LOWsrc/cowrie/shell/bashparse.py1153CODE
LOWsrc/cowrie/shell/fs.py263CODE
LOWsrc/cowrie/shell/pipe.py102CODE
LOWsrc/cowrie/shell/pipe.py328CODE
LOWsrc/cowrie/shell/honeypot.py448CODE
LOWsrc/cowrie/shell/honeypot.py503CODE
LOWsrc/cowrie/shell/honeypot.py675CODE
LOWsrc/cowrie/shell/honeypot.py817CODE
LOWsrc/cowrie/shell/honeypot.py1151CODE
LOWsrc/cowrie/output/postgresql.py109CODE
LOWsrc/cowrie/output/dshield.py96CODE
LOWsrc/cowrie/output/abuseipdb.py45CODE
LOWsrc/cowrie/output/abuseipdb.py142CODE
LOWsrc/cowrie/output/influx.py113CODE
LOWsrc/cowrie/output/misp.py93CODE
LOWsrc/cowrie/output/misp.py310CODE
LOWsrc/cowrie/output/sqlite.py70CODE
LOWsrc/cowrie/output/prometheus.py118CODE
LOWsrc/cowrie/output/hpfeeds3.py60CODE
LOWsrc/cowrie/output/mysql.py122CODE
LOWsrc/cowrie/ssh_proxy/protocols/term.py74CODE
LOWsrc/cowrie/ssh_proxy/protocols/port_forward.py29CODE
LOWsrc/cowrie/ssh_proxy/protocols/sftp.py109CODE
LOWsrc/cowrie/ssh_proxy/protocols/ssh.py93CODE
LOWsrc/cowrie/ssh/forwarding.py131CODE
LOWsrc/cowrie/ssh/forwarding.py226CODE
LOWsrc/cowrie/ssh/userauth.py174CODE
LOWsrc/cowrie/ssh/factory.py61CODE
LOWsrc/cowrie/scripts/playlog.py18CODE
LOWsrc/cowrie/scripts/playlog.py104CODE
LOWsrc/cowrie/scripts/fsctl.py810CODE
LOWsrc/cowrie/scripts/createfs.py95CODE
LOWsrc/cowrie/scripts/createfs.py193CODE
LOWsrc/cowrie/scripts/cowrie.py287CODE
LOWsrc/cowrie/scripts/asciinema.py21CODE
LOWsrc/cowrie/commands/uname.py84CODE
LOWsrc/cowrie/commands/git.py20CODE
LOWsrc/cowrie/commands/wc.py74CODE
LOWsrc/cowrie/commands/tee.py37CODE
LOWsrc/cowrie/commands/base64.py29CODE
LOWsrc/cowrie/commands/curl.py219CODE
LOWsrc/cowrie/commands/curl.py487CODE
LOWsrc/cowrie/commands/chmod.py81CODE
LOWsrc/cowrie/commands/sed.py92CODE
LOWsrc/cowrie/commands/sed.py414CODE
LOWsrc/cowrie/commands/sed.py428CODE
LOWsrc/cowrie/commands/sed.py242CODE
LOWsrc/cowrie/commands/sed.py341CODE
LOWsrc/cowrie/commands/sed.py474CODE
LOWsrc/cowrie/commands/sed.py612CODE
LOWsrc/cowrie/commands/sed.py673CODE
41 more matches not shown…
Cross-File Repetition20 hits · 100 pts
SeverityFileLineSnippetContext
HIGHsrc/cowrie/test/test_output_postgresql.py0construct the plugin without running its config-reading start().STRING
HIGHsrc/cowrie/test/test_output_sqlite.py0construct the plugin without running its config-reading start().STRING
HIGHsrc/cowrie/test/test_output_mysql.py0construct the plugin without running its config-reading start().STRING
HIGHsrc/cowrie/test/test_output_slack.py0construct the plugin without running its config-reading start().STRING
HIGHsrc/cowrie/test/test_output_postgresql.py0stop() must not raise when start() never created the pool.STRING
HIGHsrc/cowrie/test/test_output_sqlite.py0stop() must not raise when start() never created the pool.STRING
HIGHsrc/cowrie/test/test_output_mysql.py0stop() must not raise when start() never created the pool.STRING
HIGHsrc/cowrie/test/test_output_mongodb.py0stop() must not raise when start() never connected.STRING
HIGHsrc/cowrie/test/test_output_rethinkdblog.py0stop() must not raise when start() never connected.STRING
HIGHsrc/cowrie/test/test_output_redis.py0stop() must not raise when start() never connected.STRING
HIGHsrc/cowrie/ssh_proxy/client_transport.py0make sure all sessions time out eventually. timeout is reset when authentication succeeds.STRING
HIGHsrc/cowrie/ssh_proxy/server_transport.py0make sure all sessions time out eventually. timeout is reset when authentication succeeds.STRING
HIGHsrc/cowrie/ssh/transport.py0make sure all sessions time out eventually. timeout is reset when authentication succeeds.STRING
HIGHsrc/cowrie/telnet_proxy/client_transport.py0make sure all sessions time out eventually. timeout is reset when authentication succeeds.STRING
HIGHsrc/cowrie/telnet_proxy/server_transport.py0make sure all sessions time out eventually. timeout is reset when authentication succeeds.STRING
HIGHsrc/cowrie/telnet/transport.py0make sure all sessions time out eventually. timeout is reset when authentication succeeds.STRING
HIGHsrc/cowrie/telnet_proxy/server_transport.py0telnet transport and authentication for the honeypot @author: olivier bilodeau <obilodeau@gosecure.ca>STRING
HIGHsrc/cowrie/telnet/transport.py0telnet transport and authentication for the honeypot @author: olivier bilodeau <obilodeau@gosecure.ca>STRING
HIGHsrc/cowrie/telnet/userauth.py0telnet transport and authentication for the honeypot @author: olivier bilodeau <obilodeau@gosecure.ca>STRING
HIGHsrc/cowrie/telnet/factory.py0telnet transport and authentication for the honeypot @author: olivier bilodeau <obilodeau@gosecure.ca>STRING
Over-Commented Block39 hits · 39 pts
SeverityFileLineSnippetContext
LOWrequirements-output.txt1# SPDX-FileCopyrightText: 2017 lelonek1 <lelonek1@umbc.edu>COMMENT
LOWbin/build-fs-pickle.sh1#!/bin/shCOMMENT
LOWdocs/conf.py1# SPDX-FileCopyrightText: 2019-2025 Michel Oosterhof <michel@oosterhof.net>COMMENT
LOWdocs/conf.py61# Add any paths that contain templates here, relative to this directory.COMMENT
LOWdocs/conf.py81# directories to ignore when looking for source files.COMMENT
LOWdocs/conf.py101COMMENT
LOWdocs/conf.py121htmlhelp_basename = "cowriedoc"COMMENT
LOWsrc/cowrie/llm/__init__.py1# SPDX-FileCopyrightText: 2025 Michel Oosterhof <michel@oosterhof.net>COMMENT
LOWsrc/cowrie/core/__init__.py1# SPDX-FileCopyrightText: 2009 Upi Tamminen <desaster@gmail.com>COMMENT
LOWsrc/cowrie/core/ocsf.py1# SPDX-FileCopyrightText: 2026 JustSamAgain justsamagain@proton.meCOMMENT
LOWsrc/cowrie/test/fake_transport.py101 protocol="test",COMMENT
LOWsrc/cowrie/test/__init__.py1# SPDX-FileCopyrightText: 2009 Upi Tamminen <desaster@gmail.com>COMMENT
LOWsrc/cowrie/python/__init__.py1# SPDX-FileCopyrightText: 2009 Upi Tamminen <desaster@gmail.com>COMMENT
LOWsrc/cowrie/shell/command.py41 # already exited (a download completing after an abort) checks this so aCOMMENT
LOWsrc/cowrie/shell/__init__.py1# SPDX-FileCopyrightText: 2009 Upi Tamminen <desaster@gmail.com>COMMENT
LOWsrc/cowrie/shell/bashparse.py81COMMENT
LOWsrc/cowrie/shell/bashparse.py101# test_bashparse asserts it with an explicit-ambiguity parse of sample lines.COMMENT
LOWsrc/cowrie/shell/bashparse.py121// A function definition's "()" is one token, so "f()", "f ()" and "f ( )"COMMENT
LOWsrc/cowrie/shell/pipe.py61 # command: redirection targets resolve against the cwd, and the filesCOMMENT
LOWsrc/cowrie/shell/honeypot.py101 # subshell stays a single unit here so its &&/|| gate covers the wholeCOMMENT
LOWsrc/cowrie/shell/honeypot.py141 self.bashparser = BashParser(self)COMMENT
LOWsrc/cowrie/shell/honeypot.py181 # child captures its stdout. ``done`` fires with the finished childCOMMENT
LOWsrc/cowrie/output/telegram.py41 def write(self, event):COMMENT
LOWsrc/cowrie/pool_interface/__init__.py1# SPDX-FileCopyrightText: 2009 Upi Tamminen <desaster@gmail.com>COMMENT
LOWsrc/cowrie/ssh_proxy/__init__.py1# SPDX-FileCopyrightText: 2009 Upi Tamminen <desaster@gmail.com>COMMENT
LOWsrc/cowrie/ssh_proxy/protocols/__init__.py1# SPDX-FileCopyrightText: 2009 Upi Tamminen <desaster@gmail.com>COMMENT
LOWsrc/cowrie/ssh_proxy/protocols/sftp.py21# # ['uint32', 'version'], [['string', 'extension_name'], ['string', 'extension_data']]]COMMENT
LOWsrc/cowrie/ssh_proxy/protocols/sftp.py41# 18: "SSH_FXP_RENAME", # [['uint32', 'id'], ['string', 'oldpath'], ['string', 'newpath']]COMMENT
LOWsrc/cowrie/ssh_proxy/protocols/ssh.py41# 21: "SSH_MSG_NEWKEYS",COMMENT
LOWsrc/cowrie/ssh/__init__.py1# SPDX-FileCopyrightText: 2009 Upi Tamminen <desaster@gmail.com>COMMENT
LOWsrc/cowrie/scripts/dumpfs.py1#!/usr/bin/env python3COMMENT
LOWsrc/cowrie/scripts/__init__.py1# SPDX-FileCopyrightText: 2009 Upi Tamminen <desaster@gmail.com>COMMENT
LOWsrc/cowrie/scripts/fsctl.py1#!/usr/bin/env pythonCOMMENT
LOWsrc/cowrie/scripts/createfs.py1#!/usr/bin/env pythonCOMMENT
LOWsrc/cowrie/telnet_proxy/__init__.py1# SPDX-FileCopyrightText: 2009 Upi Tamminen <desaster@gmail.com>COMMENT
LOWsrc/cowrie/telnet/__init__.py1# SPDX-FileCopyrightText: 2009 Upi Tamminen <desaster@gmail.com>COMMENT
LOWsrc/cowrie/insults/__init__.py1# SPDX-FileCopyrightText: 2009 Upi Tamminen <desaster@gmail.com>COMMENT
LOWsrc/backend_pool/__init__.py1# SPDX-FileCopyrightText: 2009 Upi Tamminen <desaster@gmail.com>COMMENT
LOWsrc/backend_pool/libvirt/__init__.py1# SPDX-FileCopyrightText: 2009 Upi Tamminen <desaster@gmail.com>COMMENT
Redundant / Tautological Comments19 hits · 30 pts
SeverityFileLineSnippetContext
LOW.github/workflows/fingerprint.yml76 # Check if container is runningCOMMENT
LOW.github/workflows/fingerprint.yml233 # Check if advanced tests detected honeypotCOMMENT
LOW⚡.github/scripts/advanced-honeypot-tests.py162 # Check if all commands execute too quickly (< 10ms)COMMENT
LOW⚡.github/scripts/advanced-honeypot-tests.py179 # Check if common binaries exist and have reasonable sizesCOMMENT
LOW⚡.github/scripts/advanced-honeypot-tests.py209 # Check if it shows the SSH connection we're usingCOMMENT
LOW.github/scripts/advanced-honeypot-tests.py57 # Check if ping actually works (Cowrie simulates it)COMMENT
LOW.github/scripts/advanced-honeypot-tests.py124 # Check if /proc/self/exe exists and is validCOMMENT
LOW.github/scripts/advanced-honeypot-tests.py264 # Print resultsCOMMENT
LOWsrc/cowrie/core/auth.py220 # Check if it is the first visit from src_ipCOMMENT
LOWsrc/cowrie/core/auth.py275 # Check if enough login attempts are triedCOMMENT
LOWsrc/cowrie/core/checkers.py148 # Check if authclass exists in the auth module, fall back to UserDBCOMMENT
LOWsrc/cowrie/output/abuseipdb.py157 # Check if reported IP is ready for re-reportingCOMMENT
LOWsrc/cowrie/output/virustotal.py440 # Check if URL has been scannedCOMMENT
LOWsrc/cowrie/output/slack.py142 # Check if we have a handler for this eventCOMMENT
LOWsrc/cowrie/scripts/cowrie.py132 # Check if already runningCOMMENT
LOWsrc/cowrie/commands/tftp.py204 # Check if this is the expected blockCOMMENT
LOWsrc/cowrie/commands/tftp.py235 # Check if this is the last packet (< 512 bytes of data)COMMENT
LOWsrc/cowrie/commands/tftp.py505 # Check if this is a cancellation (from CTRL-C)COMMENT
LOWsrc/cowrie/commands/sleep.py70 # Check if the error was caused by a long option (--option)STRING
Self-Referential Comments9 hits · 25 pts
SeverityFileLineSnippetContext
MEDIUMsrc/cowrie/test/fake_transport.py23 """This class is placeholder for creating a fake interface.STRING
MEDIUMsrc/cowrie/test/test_telnet_transport.py61 # Create a failure with AlreadyNegotiatingCOMMENT
MEDIUMsrc/cowrie/test/test_telnet_transport.py81 # Create a failure with AlreadyNegotiatingCOMMENT
MEDIUMsrc/cowrie/test/test_telnet_transport.py99 # Create a mock Deferred for onResultCOMMENT
MEDIUMsrc/cowrie/test/test_virustotal.py102 # Create a temporary file for testingCOMMENT
MEDIUMsrc/cowrie/shell/honeypot.py837 # Defining a function records its body and succeeds.COMMENT
MEDIUMsrc/cowrie/output/misp.py257 # Create a comprehensive session event if there's activity worth reportingCOMMENT
MEDIUMsrc/cowrie/commands/ls.py141 # Create a list to hold formatted sizes for displayCOMMENT
MEDIUMsrc/cowrie/commands/su.py155 # Create a non-interactive shell running as the target user. TheCOMMENT
Hallucination Indicators2 hits · 20 pts
SeverityFileLineSnippetContext
CRITICALsrc/cowrie/llm/session.py42 self.avatar.conn.transport.events.dispatch(CODE
CRITICALsrc/cowrie/shell/session.py99 self.avatar.conn.transport.events.dispatch(CODE
AI Slop Vocabulary5 hits · 15 pts
SeverityFileLineSnippetContext
MEDIUMsrc/cowrie/shell/honeypot.py961 # Probably no reason to be this comprehensive for just PATH...COMMENT
MEDIUMsrc/cowrie/output/misp.py68 # Session tracking for comprehensive session eventsCOMMENT
MEDIUMsrc/cowrie/output/misp.py238 # When a session closes, create a comprehensive eventCOMMENT
MEDIUMsrc/cowrie/output/misp.py257 # Create a comprehensive session event if there's activity worth reportingCOMMENT
MEDIUMsrc/cowrie/output/misp.py577 # Add comprehensive text summaryCOMMENT
Decorative Section Separators4 hits · 12 pts
SeverityFileLineSnippetContext
MEDIUMsrc/cowrie/output/discord.py32# -----------------COMMENT
MEDIUMsrc/cowrie/output/discord.py34# -----------------COMMENT
MEDIUMsrc/cowrie/output/prometheus.py26# ────────────────────────────────────────────COMMENT
MEDIUMsrc/cowrie/output/prometheus.py28# ────────────────────────────────────────────COMMENT
Modern Structural Boilerplate9 hits · 9 pts
SeverityFileLineSnippetContext
LOW.github/scripts/advanced-honeypot-tests.py19logger = logging.getLogger(__name__)CODE
LOWsrc/cowrie/test/test_temp_file_naming.py41 def update_realfile(self, f: list, realfile: str) -> None:CODE
LOWsrc/cowrie/test/test_honeyfs.py188 def _set_contents_path(self, path: str) -> None:CODE
LOWsrc/cowrie/shell/command.py125 def set_input_data(self, data: bytes) -> None:CODE
LOWsrc/cowrie/shell/fs.py251 def update_realfile(self, f: Node | None, realfile: str) -> None:CODE
LOWsrc/cowrie/shell/fs.py659 def update_size(self, filename: str, size: int) -> None:CODE
LOWsrc/cowrie/shell/pipe.py102 def _setup_redirections(self) -> None:CODE
LOWsrc/cowrie/output/rmq.py106 def _setup_failed(self, reason: Failure, connection: Any) -> None:CODE
LOWsrc/cowrie/output/mongodb.py93 def update_session(self, session: str, fields: dict[str, Any]) -> None:CODE
Example Usage Blocks1 hit · 2 pts
SeverityFileLineSnippetContext
LOWsrc/cowrie/scripts/dumpfs.py11# Usage:COMMENT
AI Structural Patterns1 hit · 1 pts
SeverityFileLineSnippetContext
LOWsrc/cowrie/shell/customparser.py28CODE