Home / cowrie / cowrie
Repository Analysis

cowrie/cowrie

Cowrie SSH/Telnet Honeypot https://docs.cowrie.org/

31.4 Strong AI signal View on GitHub

Analysis Overview

This report presents the forensic synthetic code analysis of cowrie/cowrie, a Python project with 6,482 GitHub stars. SynthScan v2.0 examined 57,703 lines of code across 360 source files, recording 1313 pattern matches distributed across 15 syntactic categories. The overall adjusted score of 31.4 places this repository in the Strong AI signal band.

The scanner applied 160+ deterministic lexical heuristics, multi-line block detectors, abstract syntax tree depth profilers, and a cross-file Jaccard similarity matrix to construct a statistically normalised synthetic code estimate. All matches are individually weighted by severity coefficient and contextual multiplier before summation, and the resulting headline score is temporally discounted to account for the repository's development history relative to the commercial emergence of large language model coding tooling (November 2022 onward).

31.4
Adjusted Score
31.4
Raw Score
100%
Time Factor
2026-07-31
Last Push
6.5K
Stars
Python
Language
57.7K
Lines of Code
360
Files
1.3K
Pattern Hits
2026-08-02
Scan Date
0.16
HC Hit Rate

What These Metrics Mean

Adjusted Score
Primary synthetic code indicator. Raw score normalised per 1,000 lines of code and multiplied by the temporal discount factor. This is the definitive comparative metric — use it to rank repositories by AI authorship density.
Raw Score
The unmodified sum of all severity-weighted, context-multiplied pattern match scores before temporal discounting. Reflects the absolute signal strength independent of when the repository was last active.
Time Factor
The temporal discount multiplier (0–100%) applied to the raw score. Repositories last updated before ChatGPT's launch (Nov 2022) receive a 5% factor. Full signal is only assigned to repositories active in the post-adoption era (Jan 2024+).
Pattern Hits
Total count of individual pattern matches across all files and categories. A high hit count with a low score may indicate a very large codebase with isolated AI snippets; a low count with a high score indicates dense, concentrated AI signatures.
HC Hit Rate
High+Critical pattern hits per file, averaged across the repository. This orthogonal signal catches repositories where a few files are densely packed with high-severity AI tells — a strong indicator even when the normalised score appears moderate due to codebase size.
Lines of Code / Files
Total lines and files analysed. The scanner examines 94 file extensions. These denominators are used to normalise the score, enabling fair comparison between repositories of vastly different sizes.

Score History

Longitudinal tracking requires multiple scan runs. Once this repository is re-scanned after new commits land, this chart will visualise how the synthetic code signal evolves over time — enabling you to detect whether AI authorship is growing, stabilising, or being actively corrected by human engineers.

No multi-scan history yet — run the scanner again to build trend data.

Severity Breakdown

Classifies detected patterns by their diagnostic confidence and structural impact. CRITICAL patterns (coefficient 10) represent definitive synthetic signatures — hallucinated imports, explicit LLM attribution metadata — virtually never produced by human authors. HIGH (5) indicates strong structural tells such as cross-file repetition or cross-linguistic idioms. MEDIUM (2) covers recognisable conversational padding and AI-specific vocabulary. LOW (1) captures subtle indicators like tautological comments and generic boilerplate that require density to carry independent signal.

CRITICAL 2HIGH 55MEDIUM 30LOW 1226

Directory Score Breakdown

This horizontal bar chart decomposes the repository's raw synthetic code score by top-level directory, allowing you to pinpoint precisely which modules or components carry the highest AI authorship density. Directories with disproportionately high scores relative to their size warrant targeted manual review: concentrated AI signatures often trace back to mass-generated configuration layers, auto-ported test suites, LLM-scaffolded boilerplate classes, or entire subsystems authored under heavy copilot assistance. Use this view to prioritise your human code-review effort.

Pattern Findings

The scanner identified 1313 distinct pattern matches across 15 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a statistically significant AI authorship indicator. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the diagnostic confidence level (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — comment-context matches receive a ×1.5 weight because LLMs systematically over-annotate. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier as dense clusters constitute far stronger evidence of synthetic authorship than isolated hits.

Hyper-Verbose Identifiers694 hits · 834 pts
SeverityFileLineSnippetContext
LOW⚡.github/scripts/advanced-honeypot-tests.py172 def test_filesystem_consistency(self, client: paramiko.SSHClient) -> bool:CODE
LOWsrc/cowrie/llm/protocol.py250 def _process_command_with_llm(self, command: str) -> None:CODE
LOWsrc/cowrie/core/utils.py159def get_endpoints_from_section(CODE
LOWsrc/cowrie/test/test_parser.py51 def test_stderr_to_devnull_inline(self) -> None:CODE
LOWsrc/cowrie/test/test_parser.py73 def test_multiple_redirections(self) -> None:CODE
LOWsrc/cowrie/test/test_parser.py87 def test_redirect_without_target(self) -> None:CODE
LOWsrc/cowrie/test/test_parser.py121 def test_redirect_both_stdout_stderr(self) -> None:CODE
LOWsrc/cowrie/test/test_parser.py133 def test_redirect_both_append(self) -> None:CODE
LOWsrc/cowrie/test/test_parser.py139 def test_redirect_both_inline_target(self) -> None:CODE
LOW⚡src/cowrie/test/test_resources.py18 def test_returns_bytes_for_existing_resource(self) -> None:CODE
LOW⚡src/cowrie/test/test_resources.py23 def test_raises_file_not_found_for_missing_resource(self) -> None:CODE
LOW⚡src/cowrie/test/test_resources.py27 def test_raises_file_not_found_for_missing_subpath(self) -> None:CODE
LOW⚡src/cowrie/test/test_resources.py31 def test_raises_file_not_found_for_directory(self) -> None:CODE
LOW⚡src/cowrie/test/test_resources.py39 def test_raises_file_not_found_for_directory_via_empty_subpath(self) -> None:CODE
LOW⚡src/cowrie/test/test_resources.py49 def test_yields_readable_binary_stream(self) -> None:CODE
LOW⚡src/cowrie/test/test_resources.py55 def test_raises_file_not_found_for_missing_resource(self) -> None:CODE
LOW⚡src/cowrie/test/test_resources.py60 def test_raises_file_not_found_for_directory(self) -> None:CODE
LOWsrc/cowrie/test/test_reversedns.py72 def test_second_connect_same_ip_dispatches_again(self) -> None:CODE
LOWsrc/cowrie/test/test_reversedns.py83 def test_forward_after_connect_same_ip_dispatches(self) -> None:CODE
LOW⚡src/cowrie/test/test_reversedns.py100 def test_timeout_is_not_cached(self) -> None:CODE
LOW⚡src/cowrie/test/test_reversedns.py106 def test_servfail_is_not_cached(self) -> None:CODE
LOW⚡src/cowrie/test/test_reversedns.py112 def test_invalid_ip_does_no_lookup(self) -> None:CODE
LOW⚡src/cowrie/test/test_shell_cwd.py36 def test_top_level_cd_persists(self) -> None:CODE
LOW⚡src/cowrie/test/test_shell_cwd.py40 def test_substitution_sees_its_own_cd(self) -> None:CODE
LOW⚡src/cowrie/test/test_shell_cwd.py44 def test_substitution_cd_does_not_leak(self) -> None:CODE
LOW⚡src/cowrie/test/test_shell_cwd.py48 def test_substitution_inherits_parent_cwd(self) -> None:CODE
LOW⚡src/cowrie/test/test_shell_cwd.py54 def test_nested_sh_cd_does_not_leak(self) -> None:CODE
LOW⚡src/cowrie/test/test_shell_cwd.py58 def test_relative_path_resolves_against_shell_cwd(self) -> None:CODE
LOWsrc/cowrie/test/test_jsonlog.py35 def test_rotation_never_splits_an_event(self) -> None:CODE
LOWsrc/cowrie/test/test_curl.py54 def test_failed_download_removes_temp_artifact(self) -> None:CODE
LOWsrc/cowrie/test/test_curl.py77 def test_tcp_timeout_reports_connection_timed_out(self) -> None:CODE
LOWsrc/cowrie/test/test_curl.py98 def test_missing_host_reports_error_without_crashing(self) -> None:CODE
LOWsrc/cowrie/test/test_curl.py106 def test_exit_removes_empty_artifact(self) -> None:CODE
LOWsrc/cowrie/test/test_curl.py122 def test_artifact_close_is_idempotent(self) -> None:CODE
LOWsrc/cowrie/test/test_curl.py142 def test_late_download_callbacks_after_exit_are_inert(self) -> None:CODE
LOW⚡src/cowrie/test/test_curl.py198 def test_get_binds_agent_to_out_addr(self) -> None:CODE
LOW⚡src/cowrie/test/test_curl.py203 def test_head_binds_agent_to_out_addr(self) -> None:CODE
LOW⚡src/cowrie/test/test_curl.py208 def test_default_bind_is_wildcard(self) -> None:CODE
LOW⚡src/cowrie/test/test_curl.py256 def test_dash_output_streams_body_to_stdout(self) -> None:CODE
LOW⚡src/cowrie/test/test_curl.py260 def test_dash_output_creates_no_honeyfs_file(self) -> None:CODE
LOW⚡src/cowrie/test/test_curl.py264 def test_substitution_captures_dash_output_body(self) -> None:CODE
LOWsrc/cowrie/test/test_protocol_keystroke.py43 def test_nul_byte_logs_no_warning(self) -> None:CODE
LOWsrc/cowrie/test/test_protocol_keystroke.py54 def test_nul_byte_does_not_reach_line_buffer(self) -> None:CODE
LOW⚡src/cowrie/test/test_pool_config.py36 def test_returns_bundled_when_override_unset(self) -> None:CODE
LOW⚡src/cowrie/test/test_pool_config.py43 def test_operator_override_wins(self) -> None:CODE
LOW⚡src/cowrie/test/test_pool_config.py49 def test_missing_in_override_falls_through_to_bundled(self) -> None:CODE
LOW⚡src/cowrie/test/test_pool_config.py56 def test_missing_everywhere_raises(self) -> None:CODE
LOW⚡src/cowrie/test/test_greynoise.py52 def test_response_never_received_is_handled(self) -> None:CODE
LOW⚡src/cowrie/test/test_greynoise.py57 def test_cancelled_error_is_handled(self) -> None:CODE
LOW⚡src/cowrie/test/test_greynoise.py60 def test_dns_lookup_error_is_handled(self) -> None:CODE
LOWsrc/cowrie/test/test_utils.py42 def test_get_endpoints_from_section(self) -> None:CODE
LOWsrc/cowrie/test/test_utils.py105 def test_create_endpoint_services(self) -> None:CODE
LOW⚡src/cowrie/test/test_cut.py33 def test_cut_single_field_tab_delimiter(self) -> None:CODE
LOW⚡src/cowrie/test/test_cut.py38 def test_cut_second_field_tab_delimiter(self) -> None:CODE
LOW⚡src/cowrie/test/test_cut.py43 def test_cut_custom_delimiter(self) -> None:CODE
LOW⚡src/cowrie/test/test_cut.py63 def test_cut_open_start_range(self) -> None:CODE
LOW⚡src/cowrie/test/test_cut.py73 def test_cut_no_delimiter_in_line(self) -> None:CODE
LOW⚡src/cowrie/test/test_cut.py78 def test_cut_no_delimiter_with_s_flag(self) -> None:CODE
LOW⚡src/cowrie/test/test_cut.py83 def test_cut_field_out_of_range(self) -> None:CODE
LOW⚡src/cowrie/test/test_cut.py88 def test_cut_missing_field_spec(self) -> None:CODE
634 more matches not shown…
Unused Imports281 hits · 276 pts
SeverityFileLineSnippetContext
LOW.github/scripts/advanced-honeypot-tests.py12CODE
LOW.github/scripts/advanced-honeypot-tests.py14CODE
LOW.github/scripts/advanced-honeypot-tests.py15CODE
LOWsrc/cowrie/llm/telnet.py9CODE
LOWsrc/cowrie/llm/server.py6CODE
LOWsrc/cowrie/llm/protocol.py6CODE
LOWsrc/cowrie/llm/session.py5CODE
LOWsrc/cowrie/llm/llm.py8CODE
LOWsrc/cowrie/llm/llm.py34CODE
LOWsrc/cowrie/llm/avatar.py6CODE
LOWsrc/cowrie/llm/realm.py5CODE
LOWsrc/cowrie/core/auth.py10CODE
LOWsrc/cowrie/core/config.py10CODE
LOWsrc/cowrie/core/artifact.py25CODE
LOWsrc/cowrie/core/checkers.py10CODE
LOWsrc/cowrie/core/credentials.py5CODE
LOWsrc/cowrie/core/cef.py10CODE
LOWsrc/cowrie/core/fingerprint.py22CODE
LOWsrc/cowrie/core/events.py16CODE
LOWsrc/cowrie/core/ocsf.py21CODE
LOWsrc/cowrie/core/ttylog.py11CODE
LOWsrc/cowrie/core/utils.py6CODE
LOWsrc/cowrie/core/network.py20CODE
LOWsrc/cowrie/core/resources.py8CODE
LOWsrc/cowrie/core/uuid.py6CODE
LOWsrc/cowrie/core/output.py5CODE
LOWsrc/cowrie/test/test_parser.py8CODE
LOWsrc/cowrie/test/fake_server.py6CODE
LOWsrc/cowrie/test/test_command.py8CODE
LOWsrc/cowrie/test/test_resources.py8CODE
LOWsrc/cowrie/test/test_reversedns.py8CODE
LOWsrc/cowrie/test/test_cat.py5CODE
LOWsrc/cowrie/test/test_shell_cwd.py8CODE
LOWsrc/cowrie/test/test_jsonlog.py8CODE
LOWsrc/cowrie/test/test_curl.py8CODE
LOWsrc/cowrie/test/test_protocol_keystroke.py6CODE
LOWsrc/cowrie/test/test_pool_config.py8CODE
LOWsrc/cowrie/test/test_greynoise.py8CODE
LOWsrc/cowrie/test/test_utils.py5CODE
LOWsrc/cowrie/test/test_cut.py4CODE
LOWsrc/cowrie/test/fake_transport.py6CODE
LOWsrc/cowrie/test/test_exec_shell_stdin.py8CODE
LOWsrc/cowrie/test/test_proxy_packet_buffer.py8CODE
LOWsrc/cowrie/test/test_kafka.py8CODE
LOWsrc/cowrie/test/test_insults_events.py8CODE
LOWsrc/cowrie/test/test_session_duration.py8CODE
LOWsrc/cowrie/test/test_ftpget.py5CODE
LOWsrc/cowrie/test/test_ftpget.py33CODE
LOWsrc/cowrie/test/test_ftpget.py39CODE
LOWsrc/cowrie/test/test_llm.py8CODE
LOWsrc/cowrie/test/test_awk.py4CODE
LOWsrc/cowrie/test/test_bashparse.py8CODE
LOWsrc/cowrie/test/test_ssh_userauth.py8CODE
LOWsrc/cowrie/test/test_telnet_transport.py8CODE
LOWsrc/cowrie/test/test_cowrie_script.py8CODE
LOWsrc/cowrie/test/test_test_builtin.py8CODE
LOWsrc/cowrie/test/test_auth.py8CODE
LOWsrc/cowrie/test/test_shell_events.py8CODE
LOWsrc/cowrie/test/test_exec_builtin.py8CODE
LOWsrc/cowrie/test/test_filetransfer.py8CODE
221 more matches not shown…
Cross-Language Confusion36 hits · 248 pts
SeverityFileLineSnippetContext
HIGH⚡.github/scripts/advanced-honeypot-tests.py180 stdin, stdout, stderr = client.exec_command('ls -la /bin/bash /bin/sh /usr/bin/python* 2>/dev/null || echo "CODE
HIGH⚡.github/scripts/advanced-honeypot-tests.py205 stdin, stdout, stderr = client.exec_command('netstat -an 2>/dev/null || ss -an')CODE
HIGH⚡.github/scripts/advanced-honeypot-tests.py214 stdin, stdout, stderr = client.exec_command('ip addr || ifconfig')CODE
HIGH⚡src/cowrie/test/test_bashparse.py213 statements = self.parser.parse("a && b || c")CODE
HIGH⚡src/cowrie/test/test_bashparse.py213 statements = self.parser.parse("a && b || c")CODE
HIGH⚡src/cowrie/test/test_bashparse.py393 statements = self.parser.parse("true && for i in 1; do echo $i; done")CODE
HIGH⚡src/cowrie/test/test_test_builtin.py53 self.proto.lineReceived(b"true && echo yes")CODE
HIGH⚡src/cowrie/test/test_test_builtin.py58 self.proto.lineReceived(b"false || echo recovered")CODE
HIGH⚡src/cowrie/test/test_exec_builtin.py71 self.assertEqual(self.run_line(b"exec 2>/dev/null; echo $?"), b"0\n")CODE
HIGH⚡src/cowrie/test/test_script_execution.py173 b"printf 'for u in a b c\\ndo\\necho fetch $u && break\\ndone\\n'"CODE
HIGHsrc/cowrie/test/test_flow_control.py219 "echo fetch $url && break; done"CODE
HIGH⚡src/cowrie/test/test_exit_status.py60 self.assertEqual(self.run_line(b"true && echo ran"), b"ran\n")CODE
HIGH⚡src/cowrie/test/test_exit_status.py61 self.assertEqual(self.run_line(b"false && echo ran"), b"")CODE
HIGH⚡src/cowrie/test/test_exit_status.py64 self.assertEqual(self.run_line(b"false || echo ran"), b"ran\n")CODE
HIGH⚡src/cowrie/test/test_exit_status.py65 self.assertEqual(self.run_line(b"true || echo ran"), b"")CODE
HIGH⚡src/cowrie/test/test_exit_status.py69 self.assertEqual(self.run_line(b"false && echo a || echo b"), b"b\n")CODE
HIGH⚡src/cowrie/test/test_exit_status.py69 self.assertEqual(self.run_line(b"false && echo a || echo b"), b"b\n")CODE
HIGH⚡src/cowrie/test/test_exit_status.py71 self.assertEqual(self.run_line(b"true && echo a || echo b"), b"a\n")CODE
HIGH⚡src/cowrie/test/test_exit_status.py71 self.assertEqual(self.run_line(b"true && echo a || echo b"), b"a\n")CODE
HIGH⚡src/cowrie/test/test_exit_status.py75 self.assertEqual(self.run_line(b"false && echo x; echo $?"), b"1\n")CODE
HIGH⚡src/cowrie/test/test_exit_status.py90 self.assertEqual(self.run_line(b"bash -c false && echo ran"), b"")CODE
HIGH⚡src/cowrie/test/test_exit_status.py97 out = self.run_line(b"dd if=/nonexistentfile && echo ran")CODE
HIGH⚡src/cowrie/test/test_exit_status.py145 self.assertEqual(self.run_line(b"echo $(true || echo x)"), b"\n")CODE
HIGH⚡src/cowrie/test/test_exit_status.py146 self.assertEqual(self.run_line(b"echo $(false || echo y)"), b"y\n")CODE
HIGH⚡src/cowrie/test/test_echo.py177 self.proto.lineReceived(b"(echo first && echo second)")CODE
HIGH⚡src/cowrie/test/test_echo.py185 self.proto.lineReceived(b"(echo first || echo second)")CODE
HIGH⚡src/cowrie/test/test_async_substitution.py95 self.proto.lineReceived(b"echo $(fakeasync && echo ok)\n")CODE
HIGH⚡src/cowrie/test/test_async_substitution.py100 self.proto.lineReceived(b"echo $(fakeasync && echo ok)\n")CODE
HIGHsrc/cowrie/shell/parser.py6# ABOUTME: Handles FD redirections like 2>/dev/null, stdin redirects, and command substitution.COMMENT
HIGHsrc/cowrie/shell/honeypot.py269 A subshell is queued as one unit so its join operator (e.g. the || inSTRING
HIGHsrc/cowrie/commands/fs.py62 self.writeBytes(b"\t[--null] [pattern] [file ...]\n")CODE
HIGHsrc/cowrie/commands/ftpget.py234 self.write("ftpget: cmd (null) (null)\n")CODE
HIGHsrc/cowrie/commands/ftpget.py255 self.write("ftpget: cmd TYPE I (null)\n")CODE
HIGHsrc/cowrie/commands/ftpget.py256 self.write("ftpget: cmd PASV (null)\n")CODE
HIGHsrc/cowrie/commands/ftpget.py279 self.write("ftpget: cmd (null) (null)\n")CODE
HIGHsrc/cowrie/commands/ftpget.py280 self.write("ftpget: cmd QUIT (null)\n")CODE
Excessive Try-Catch Wrapping111 hits · 124 pts
SeverityFileLineSnippetContext
LOW⚡.github/scripts/advanced-honeypot-tests.py167 except Exception as e:CODE
LOW⚡.github/scripts/advanced-honeypot-tests.py218 except Exception as e:CODE
LOW.github/scripts/advanced-honeypot-tests.py62 except Exception as e:CODE
LOW.github/scripts/advanced-honeypot-tests.py88 except Exception as e:CODE
LOW.github/scripts/advanced-honeypot-tests.py112 except Exception as e:CODE
LOW.github/scripts/advanced-honeypot-tests.py139 except Exception as e:CODE
LOW.github/scripts/advanced-honeypot-tests.py192 except Exception as e:CODE
LOW.github/scripts/advanced-honeypot-tests.py258 except Exception as e:CODE
LOWsrc/cowrie/llm/telnet.py76 except Exception:CODE
LOWsrc/cowrie/llm/protocol.py159 except Exception:CODE
LOWsrc/cowrie/core/auth.py185 except Exception:CODE
LOWsrc/cowrie/core/fingerprint.py153 except Exception as e:CODE
LOWsrc/cowrie/core/fingerprint.py227 except Exception as e:CODE
LOWsrc/cowrie/core/events.py124 except Exception as e: # one sink must not stop the restCODE
LOWsrc/cowrie/core/network.py171 except Exception as e:CODE
LOWsrc/cowrie/shell/protocol.py120 except Exception:CODE
LOWsrc/cowrie/shell/protocol.py135 except Exception:CODE
LOWsrc/cowrie/shell/protocol.py489 except Exception:CODE
MEDIUMsrc/cowrie/shell/protocol.py486def displayMOTD(self) -> None:CODE
LOWsrc/cowrie/shell/pwd.py39 except Exception:CODE
LOWsrc/cowrie/shell/pwd.py153 except Exception:CODE
LOWsrc/cowrie/shell/fs.py129 except Exception:CODE
LOWsrc/cowrie/shell/fs.py153 except Exception as e:CODE
LOWsrc/cowrie/shell/fs.py421 except Exception:CODE
LOWsrc/cowrie/shell/fs.py436 except Exception:CODE
LOWsrc/cowrie/shell/fs.py453 except Exception:CODE
LOWsrc/cowrie/shell/pipe.py283 except Exception:CODE
LOWsrc/cowrie/shell/honeypot.py1036 except Exception:CODE
LOWsrc/cowrie/output/rmq.py90 except Exception as e:CODE
LOWsrc/cowrie/output/rmq.py147 except Exception as e:CODE
LOWsrc/cowrie/output/postgresql.py76 except Exception as e:CODE
MEDIUMsrc/cowrie/output/postgresql.py26def _runInteraction(self, interaction, *args, **kw):CODE
LOWsrc/cowrie/output/dshield.py210 except Exception as e:CODE
LOWsrc/cowrie/output/cuckoo.py117 except Exception as e:CODE
LOWsrc/cowrie/output/cuckoo.py146 except Exception as e:CODE
LOWsrc/cowrie/output/cuckoo.py173 except Exception as e:CODE
LOWsrc/cowrie/output/abuseipdb.py392 except Exception as e:CODE
LOWsrc/cowrie/output/abuseipdb.py408 except Exception:CODE
MEDIUMsrc/cowrie/output/abuseipdb.py383def http_request(self, params):CODE
LOWsrc/cowrie/output/influx.py52 except Exception:CODE
LOWsrc/cowrie/output/discord.py123 except Exception:CODE
LOW⚡src/cowrie/output/discord.py207 except Exception:CODE
LOW⚡src/cowrie/output/discord.py212 except Exception:CODE
LOW⚡src/cowrie/output/discord.py216 except Exception:CODE
LOWsrc/cowrie/output/mongodb.py25 except Exception as e:CODE
LOWsrc/cowrie/output/mongodb.py33 except Exception as e:CODE
LOWsrc/cowrie/output/mongodb.py57 except Exception as e:CODE
MEDIUMsrc/cowrie/output/mongodb.py22def insert_one(self, collection, event):CODE
MEDIUMsrc/cowrie/output/mongodb.py30def update_one(self, collection, session, doc):CODE
LOWsrc/cowrie/output/misp.py301 except Exception as e:CODE
LOWsrc/cowrie/output/prometheus.py143 except Exception as e:CODE
LOWsrc/cowrie/output/kafka.py105 except Exception as e:CODE
LOWsrc/cowrie/output/kafka.py137 except Exception as e:CODE
LOWsrc/cowrie/output/kafka.py176 except Exception as e:CODE
LOWsrc/cowrie/output/axiom.py68 except Exception as e:CODE
LOWsrc/cowrie/output/malshare.py86 except Exception as e:CODE
LOWsrc/cowrie/output/oraclecloud.py71 except Exception as ex:CODE
LOWsrc/cowrie/output/mysql.py90 except Exception as e:CODE
MEDIUMsrc/cowrie/output/mysql.py41def _runInteraction(self, interaction, *args, **kw):CODE
LOWsrc/cowrie/ssh_proxy/protocols/port_forward.py54 except Exception as e:CODE
51 more matches not shown…
Cross-File Repetition19 hits · 95 pts
SeverityFileLineSnippetContext
HIGHsrc/cowrie/test/test_output_postgresql.py0construct the plugin without running its config-reading start().STRING
HIGHsrc/cowrie/test/test_output_mongodb.py0construct the plugin without running its config-reading start().STRING
HIGHsrc/cowrie/test/test_output_rethinkdblog.py0construct the plugin without running its config-reading start().STRING
HIGHsrc/cowrie/test/test_output_sqlite.py0construct the plugin without running its config-reading start().STRING
HIGHsrc/cowrie/test/test_output_mysql.py0construct the plugin without running its config-reading start().STRING
HIGHsrc/cowrie/test/test_output_slack.py0construct the plugin without running its config-reading start().STRING
HIGHsrc/cowrie/test/test_output_postgresql.py0stop() must not raise when start() never created the pool.STRING
HIGHsrc/cowrie/test/test_output_sqlite.py0stop() must not raise when start() never created the pool.STRING
HIGHsrc/cowrie/test/test_output_mysql.py0stop() must not raise when start() never created the pool.STRING
HIGHsrc/cowrie/ssh_proxy/client_transport.py0make sure all sessions time out eventually. timeout is reset when authentication succeeds.STRING
HIGHsrc/cowrie/ssh_proxy/server_transport.py0make sure all sessions time out eventually. timeout is reset when authentication succeeds.STRING
HIGHsrc/cowrie/ssh/transport.py0make sure all sessions time out eventually. timeout is reset when authentication succeeds.STRING
HIGHsrc/cowrie/telnet_proxy/client_transport.py0make sure all sessions time out eventually. timeout is reset when authentication succeeds.STRING
HIGHsrc/cowrie/telnet_proxy/server_transport.py0make sure all sessions time out eventually. timeout is reset when authentication succeeds.STRING
HIGHsrc/cowrie/telnet/transport.py0make sure all sessions time out eventually. timeout is reset when authentication succeeds.STRING
HIGHsrc/cowrie/telnet_proxy/server_transport.py0telnet transport and authentication for the honeypot @author: olivier bilodeau <obilodeau@gosecure.ca>STRING
HIGHsrc/cowrie/telnet/transport.py0telnet transport and authentication for the honeypot @author: olivier bilodeau <obilodeau@gosecure.ca>STRING
HIGHsrc/cowrie/telnet/userauth.py0telnet transport and authentication for the honeypot @author: olivier bilodeau <obilodeau@gosecure.ca>STRING
HIGHsrc/cowrie/telnet/factory.py0telnet transport and authentication for the honeypot @author: olivier bilodeau <obilodeau@gosecure.ca>STRING
Deep Nesting88 hits · 88 pts
SeverityFileLineSnippetContext
LOWsrc/cowrie/core/auth.py197CODE
LOWsrc/cowrie/core/fingerprint.py39CODE
LOWsrc/cowrie/core/fingerprint.py167CODE
LOWsrc/cowrie/core/network.py133CODE
LOWsrc/cowrie/shell/protocol.py397CODE
LOWsrc/cowrie/shell/bashparse.py431CODE
LOWsrc/cowrie/shell/bashparse.py855CODE
LOWsrc/cowrie/shell/fs.py257CODE
LOWsrc/cowrie/shell/pipe.py104CODE
LOWsrc/cowrie/shell/pipe.py364CODE
LOWsrc/cowrie/shell/honeypot.py314CODE
LOWsrc/cowrie/shell/honeypot.py372CODE
LOWsrc/cowrie/shell/honeypot.py543CODE
LOWsrc/cowrie/shell/honeypot.py720CODE
LOWsrc/cowrie/shell/honeypot.py1010CODE
LOWsrc/cowrie/output/rmq.py103CODE
LOWsrc/cowrie/output/postgresql.py109CODE
LOWsrc/cowrie/output/dshield.py96CODE
LOWsrc/cowrie/output/abuseipdb.py45CODE
LOWsrc/cowrie/output/abuseipdb.py142CODE
LOWsrc/cowrie/output/influx.py113CODE
LOWsrc/cowrie/output/misp.py93CODE
LOWsrc/cowrie/output/misp.py304CODE
LOWsrc/cowrie/output/sqlite.py60CODE
LOWsrc/cowrie/output/prometheus.py112CODE
LOWsrc/cowrie/output/hpfeeds3.py60CODE
LOWsrc/cowrie/output/mysql.py122CODE
LOWsrc/cowrie/ssh_proxy/protocols/term.py74CODE
LOWsrc/cowrie/ssh_proxy/protocols/port_forward.py29CODE
LOWsrc/cowrie/ssh_proxy/protocols/sftp.py114CODE
LOWsrc/cowrie/ssh_proxy/protocols/ssh.py93CODE
LOWsrc/cowrie/ssh/forwarding.py131CODE
LOWsrc/cowrie/ssh/forwarding.py226CODE
LOWsrc/cowrie/ssh/userauth.py174CODE
LOWsrc/cowrie/ssh/factory.py63CODE
LOWsrc/cowrie/scripts/playlog.py18CODE
LOWsrc/cowrie/scripts/playlog.py104CODE
LOWsrc/cowrie/scripts/fsctl.py798CODE
LOWsrc/cowrie/scripts/createfs.py95CODE
LOWsrc/cowrie/scripts/createfs.py193CODE
LOWsrc/cowrie/scripts/cowrie.py287CODE
LOWsrc/cowrie/scripts/asciinema.py21CODE
LOWsrc/cowrie/commands/uname.py84CODE
LOWsrc/cowrie/commands/git.py20CODE
LOWsrc/cowrie/commands/wc.py72CODE
LOWsrc/cowrie/commands/tee.py35CODE
LOWsrc/cowrie/commands/base64.py29CODE
LOWsrc/cowrie/commands/curl.py219CODE
LOWsrc/cowrie/commands/curl.py489CODE
LOWsrc/cowrie/commands/chmod.py56CODE
LOWsrc/cowrie/commands/locate.py58CODE
LOWsrc/cowrie/commands/locate.py89CODE
LOWsrc/cowrie/commands/cut.py22CODE
LOWsrc/cowrie/commands/ls.py76CODE
LOWsrc/cowrie/commands/ls.py126CODE
LOWsrc/cowrie/commands/awk.py31CODE
LOWsrc/cowrie/commands/awk.py105CODE
LOWsrc/cowrie/commands/groups.py35CODE
LOWsrc/cowrie/commands/su.py56CODE
LOWsrc/cowrie/commands/free.py91CODE
28 more matches not shown…
Over-Commented Block34 hits · 34 pts
SeverityFileLineSnippetContext
LOWrequirements-output.txt1# SPDX-FileCopyrightText: 2017 lelonek1 <lelonek1@umbc.edu>COMMENT
LOWbin/build-fs-pickle.sh1#!/bin/shCOMMENT
LOWdocs/conf.py1# SPDX-FileCopyrightText: 2019-2025 Michel Oosterhof <michel@oosterhof.net>COMMENT
LOWdocs/conf.py61# Add any paths that contain templates here, relative to this directory.COMMENT
LOWdocs/conf.py81# directories to ignore when looking for source files.COMMENT
LOWdocs/conf.py101COMMENT
LOWdocs/conf.py121htmlhelp_basename = "cowriedoc"COMMENT
LOWsrc/cowrie/llm/__init__.py1# SPDX-FileCopyrightText: 2025 Michel Oosterhof <michel@oosterhof.net>COMMENT
LOWsrc/cowrie/core/__init__.py1# SPDX-FileCopyrightText: 2009 Upi Tamminen <desaster@gmail.com>COMMENT
LOWsrc/cowrie/core/ocsf.py1# SPDX-FileCopyrightText: 2026 JustSamAgain justsamagain@proton.meCOMMENT
LOWsrc/cowrie/test/fake_transport.py101 protocol="test",COMMENT
LOWsrc/cowrie/test/__init__.py1# SPDX-FileCopyrightText: 2009 Upi Tamminen <desaster@gmail.com>COMMENT
LOWsrc/cowrie/python/__init__.py1# SPDX-FileCopyrightText: 2009 Upi Tamminen <desaster@gmail.com>COMMENT
LOWsrc/cowrie/shell/protocol.py301 if self.pp:COMMENT
LOWsrc/cowrie/shell/__init__.py1# SPDX-FileCopyrightText: 2009 Upi Tamminen <desaster@gmail.com>COMMENT
LOWsrc/cowrie/shell/bashparse.py81# parentheses, ";;", newlines). The structure above a simple command --COMMENT
LOWsrc/cowrie/shell/fs.py461 # Below additions for SFTP support, try to keep functions here similar to os.*COMMENT
LOWsrc/cowrie/shell/honeypot.py141 self.captured: bytes = b""COMMENT
LOWsrc/cowrie/pool_interface/__init__.py1# SPDX-FileCopyrightText: 2009 Upi Tamminen <desaster@gmail.com>COMMENT
LOWsrc/cowrie/ssh_proxy/__init__.py1# SPDX-FileCopyrightText: 2009 Upi Tamminen <desaster@gmail.com>COMMENT
LOWsrc/cowrie/ssh_proxy/protocols/__init__.py1# SPDX-FileCopyrightText: 2009 Upi Tamminen <desaster@gmail.com>COMMENT
LOWsrc/cowrie/ssh_proxy/protocols/sftp.py21# # ['uint32', 'version'], [['string', 'extension_name'], ['string', 'extension_data']]]COMMENT
LOWsrc/cowrie/ssh_proxy/protocols/sftp.py41# 18: "SSH_FXP_RENAME", # [['uint32', 'id'], ['string', 'oldpath'], ['string', 'newpath']]COMMENT
LOWsrc/cowrie/ssh_proxy/protocols/ssh.py41# 21: "SSH_MSG_NEWKEYS",COMMENT
LOWsrc/cowrie/ssh/__init__.py1# SPDX-FileCopyrightText: 2009 Upi Tamminen <desaster@gmail.com>COMMENT
LOWsrc/cowrie/scripts/dumpfs.py1#!/usr/bin/env python3COMMENT
LOWsrc/cowrie/scripts/__init__.py1# SPDX-FileCopyrightText: 2009 Upi Tamminen <desaster@gmail.com>COMMENT
LOWsrc/cowrie/scripts/fsctl.py1#!/usr/bin/env pythonCOMMENT
LOWsrc/cowrie/scripts/createfs.py1#!/usr/bin/env pythonCOMMENT
LOWsrc/cowrie/telnet_proxy/__init__.py1# SPDX-FileCopyrightText: 2009 Upi Tamminen <desaster@gmail.com>COMMENT
LOWsrc/cowrie/telnet/__init__.py1# SPDX-FileCopyrightText: 2009 Upi Tamminen <desaster@gmail.com>COMMENT
LOWsrc/cowrie/insults/__init__.py1# SPDX-FileCopyrightText: 2009 Upi Tamminen <desaster@gmail.com>COMMENT
LOWsrc/backend_pool/__init__.py1# SPDX-FileCopyrightText: 2009 Upi Tamminen <desaster@gmail.com>COMMENT
LOWsrc/backend_pool/libvirt/__init__.py1# SPDX-FileCopyrightText: 2009 Upi Tamminen <desaster@gmail.com>COMMENT
Redundant / Tautological Comments21 hits · 33 pts
SeverityFileLineSnippetContext
LOW.github/workflows/fingerprint.yml76 # Check if container is runningCOMMENT
LOW.github/workflows/fingerprint.yml233 # Check if advanced tests detected honeypotCOMMENT
LOW⚡.github/scripts/advanced-honeypot-tests.py162 # Check if all commands execute too quickly (< 10ms)COMMENT
LOW⚡.github/scripts/advanced-honeypot-tests.py179 # Check if common binaries exist and have reasonable sizesCOMMENT
LOW⚡.github/scripts/advanced-honeypot-tests.py209 # Check if it shows the SSH connection we're usingCOMMENT
LOW.github/scripts/advanced-honeypot-tests.py57 # Check if ping actually works (Cowrie simulates it)COMMENT
LOW.github/scripts/advanced-honeypot-tests.py124 # Check if /proc/self/exe exists and is validCOMMENT
LOW.github/scripts/advanced-honeypot-tests.py264 # Print resultsCOMMENT
LOWsrc/cowrie/core/auth.py220 # Check if it is the first visit from src_ipCOMMENT
LOWsrc/cowrie/core/auth.py275 # Check if enough login attempts are triedCOMMENT
LOWsrc/cowrie/core/checkers.py148 # Check if authclass exists in the auth module, fall back to UserDBCOMMENT
LOWsrc/cowrie/output/abuseipdb.py157 # Check if reported IP is ready for re-reportingCOMMENT
LOWsrc/cowrie/output/virustotal.py440 # Check if URL has been scannedCOMMENT
LOWsrc/cowrie/output/mongodb.py72 # Check if sensor exists, else add it.COMMENT
LOWsrc/cowrie/output/slack.py142 # Check if we have a handler for this eventCOMMENT
LOWsrc/cowrie/scripts/cowrie.py132 # Check if already runningCOMMENT
LOWsrc/cowrie/commands/tftp.py209 # Check if this is the expected blockCOMMENT
LOWsrc/cowrie/commands/tftp.py240 # Check if this is the last packet (< 512 bytes of data)COMMENT
LOWsrc/cowrie/commands/tftp.py510 # Check if this is a cancellation (from CTRL-C)COMMENT
LOWsrc/cowrie/commands/sleep.py70 # Check if the error was caused by a long option (--option)STRING
LOWsrc/cowrie/commands/finger.py30 # Loop over the data in sets of 7COMMENT
Self-Referential Comments9 hits · 25 pts
SeverityFileLineSnippetContext
MEDIUMsrc/cowrie/test/fake_transport.py23 """This class is placeholder for creating a fake interface.STRING
MEDIUMsrc/cowrie/test/test_telnet_transport.py61 # Create a failure with AlreadyNegotiatingCOMMENT
MEDIUMsrc/cowrie/test/test_telnet_transport.py81 # Create a failure with AlreadyNegotiatingCOMMENT
MEDIUMsrc/cowrie/test/test_telnet_transport.py99 # Create a mock Deferred for onResultCOMMENT
MEDIUMsrc/cowrie/test/test_virustotal.py101 # Create a temporary file for testingCOMMENT
MEDIUMsrc/cowrie/shell/honeypot.py687 # Defining a function records its body and succeeds.COMMENT
MEDIUMsrc/cowrie/output/misp.py257 # Create a comprehensive session event if there's activity worth reportingCOMMENT
MEDIUMsrc/cowrie/commands/ls.py137 # Create a list to hold formatted sizes for displayCOMMENT
MEDIUMsrc/cowrie/commands/su.py155 # Create a non-interactive shell running as the target user. TheCOMMENT
Hallucination Indicators2 hits · 20 pts
SeverityFileLineSnippetContext
CRITICALsrc/cowrie/llm/session.py42 self.avatar.conn.transport.events.dispatch(CODE
CRITICALsrc/cowrie/shell/session.py95 self.avatar.conn.transport.events.dispatch(CODE
AI Slop Vocabulary5 hits · 15 pts
SeverityFileLineSnippetContext
MEDIUMsrc/cowrie/shell/honeypot.py726 # Probably no reason to be this comprehensive for just PATH...COMMENT
MEDIUMsrc/cowrie/output/misp.py68 # Session tracking for comprehensive session eventsCOMMENT
MEDIUMsrc/cowrie/output/misp.py238 # When a session closes, create a comprehensive eventCOMMENT
MEDIUMsrc/cowrie/output/misp.py257 # Create a comprehensive session event if there's activity worth reportingCOMMENT
MEDIUMsrc/cowrie/output/misp.py571 # Add comprehensive text summaryCOMMENT
Decorative Section Separators4 hits · 12 pts
SeverityFileLineSnippetContext
MEDIUMsrc/cowrie/output/discord.py32# -----------------COMMENT
MEDIUMsrc/cowrie/output/discord.py34# -----------------COMMENT
MEDIUMsrc/cowrie/output/prometheus.py25# ────────────────────────────────────────────COMMENT
MEDIUMsrc/cowrie/output/prometheus.py27# ────────────────────────────────────────────COMMENT
Modern Structural Boilerplate7 hits · 7 pts
SeverityFileLineSnippetContext
LOW.github/scripts/advanced-honeypot-tests.py19logger = logging.getLogger(__name__)CODE
LOWsrc/cowrie/test/test_temp_file_naming.py41 def update_realfile(self, f: list, realfile: str) -> None:CODE
LOWsrc/cowrie/test/test_honeyfs.py188 def _set_contents_path(self, path: str) -> None:CODE
LOWsrc/cowrie/shell/command.py124 def set_input_data(self, data: bytes) -> None:CODE
LOWsrc/cowrie/shell/fs.py245 def update_realfile(self, f: Node | None, realfile: str) -> None:CODE
LOWsrc/cowrie/shell/fs.py648 def update_size(self, filename: str, size: int) -> None:CODE
LOWsrc/cowrie/shell/pipe.py104 def _setup_redirections(self) -> None:CODE
Example Usage Blocks1 hit · 2 pts
SeverityFileLineSnippetContext
LOWsrc/cowrie/scripts/dumpfs.py11# Usage:COMMENT
AI Structural Patterns1 hit · 1 pts
SeverityFileLineSnippetContext
LOWsrc/cowrie/shell/customparser.py28CODE