Kippo alternatives and similar tools
Based on the "Security" category.
Alternatively, view Kippo alternatives based on common mentions on social networks and blogs.
OSQuery9.3 9.0 L2 Kippo VS OSQuerySQL powered operating system instrumentation, monitoring, and analytics.
lynis8.5 1.6 Kippo VS lynisLynis - Security auditing tool for Linux, macOS, and UNIX-based systems. Assists with compliance testing (HIPAA/ISO27001/PCI DSS) and system hardening. Agentless, and installation optional.
Fail2Ban8.2 7.0 L2 Kippo VS Fail2BanDaemon to ban hosts that cause multiple authentication errors
Wazuh7.7 9.9 Kippo VS WazuhWazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.
Blackbox7.6 4.8 Kippo VS BlackboxSafely store secrets in Git/Mercurial/Subversion
pfSense7.6 9.8 L2 Kippo VS pfSenseMain repository for pfSense
CrowdSec7.5 9.0 Kippo VS CrowdSecCrowdSec - the open-source and participative IPS able to analyze visitor behavior & provide an adapted response to all kinds of attacks. It also leverages the crowd power to generate a global CTI database to protect the user network.
OSSEC7.4 0.0 L2 Kippo VS OSSECOSSEC is an Open Source Host-based Intrusion Detection System that performs log analysis, file integrity checking, policy monitoring, rootkit detection, real-time alerting and active response.
Suricata7.2 9.9 Kippo VS SuricataSuricata git repository maintained by the OISF
Snort6.0 9.0 L1 Kippo VS SnortSnort++
autoVPN5.8 0.0 Kippo VS autoVPNCreate On Demand Disposable OpenVPN Endpoints on AWS.
Password Pusher5.2 6.9 Kippo VS Password Pusher🔐 An application to securely communicate passwords over the web. Passwords automatically expire after a certain number of views and/or time has passed. Track who, what and when.
fwknop4.9 0.0 L3 Kippo VS fwknopSingle Packet Authorization > Port Knocking
Glastopf4.5 0.0 L5 Kippo VS GlastopfWeb Application Honeypot
Denyhosts4.5 1.0 L3 Kippo VS DenyhostsAutomated host blocking from SSH brute force attacks
Pen Test Tools4.4 0.0 L5 Kippo VS Pen Test ToolsHomebrew Tap - Pen Test Tools
SpamAssassin3.4 5.9 L3 Kippo VS SpamAssassinRead-only mirror of Apache SpamAssassin. Submit patches to https://bz.apache.org/SpamAssassin/. Do not send pull requests
SOCless2.8 3.5 Kippo VS SOClessThe SOCless automation framework
Access the most powerful time series database as a service
* Code Quality Rankings and insights are calculated and provided by Lumnify.
They vary from L1 to L5 with "L5" being the highest.
Do you think we are missing an alternative of Kippo or a related project?
NOTE: For more recent development, check out Michel Oosterhof's fork
Kippo is a medium interaction SSH honeypot designed to log brute force attacks and, most importantly, the entire shell interaction performed by the attacker.
Kippo is inspired, but not based on Kojoney.
Some interesting logs from a live Kippo installation below (viewable within a web browser with the help of Ajaxterm). Note that some commands may have been improved since these logs were recorded.
Some interesting features:
- Fake filesystem with the ability to add/remove files. A full fake filesystem resembling a Debian 5.0 installation is included
- Possibility of adding fake file contents so the attacker can 'cat' files such as /etc/passwd. Only minimal file contents are included
- Session logs stored in an UML Compatible format for easy replay with original timings
- Just like Kojoney, Kippo saves files downloaded with wget for later inspection
- Trickery; ssh pretends to connect somewhere, exit doesn't really exit, etc
- An operating system (tested on Debian, CentOS, FreeBSD and Windows 7)
- Python 2.5+
- Twisted 8.0 to 15.1.0
- Zope Interface
See Wiki for some installation instructions.
How to run it?
Edit kippo.cfg to your liking and start the honeypot by running:
start.sh is a simple shell script that runs Kippo in the background using twistd. Detailed startup options can be given by running twistd manually. For example, to run Kippo in foreground:
twistd -y kippo.tac -n
By default Kippo listens for ssh connections on port 2222. You can change this, but do not change it to 22 as it requires root privileges. Use port forwarding instead. (More info: MakingKippoReachable).
Files of interest:
- dl/ - files downloaded with wget are stored here
- log/kippo.log - log/debug output
- log/tty/ - session logs
- utils/playlog.py - utility to replay session logs
- utils/createfs.py - used to create fs.pickle
- fs.pickle - fake filesystem
- honeyfs/ - file contents for the fake filesystem - feel free to copy a real system here
Is it secure?
Maybe. See FAQ
I have some questions!
am might be reachable via e-mail: desaster at gmail dot com, or as desaster on the #honeypots channel in the freenode IRC network.