desaster

kippo

Python2014–2023

desaster / kippo

kippo

Kippo - SSH Honeypot

Networking

Explore on GitHub Read Hacker News discussions

8Distinct people

9Mentions

1Explicit recommenders

1.7KGitHub stars

REPOSITORY AT A GLANCE

What to know before exploring

What it is

Kippo - SSH Honeypot

GitHub

Where it is used

No documented product use has been verified yet.

What people are saying

I love the creativity here! Good "active defense" posture. (Too bad it didn't seem to stop Nikto scans.) Honeypots can be fun. I vaguely remember one that generated endless…

iamnothere used a recommendation phrase. One indexed comment matches. This is a phrase match, not a verdict.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

No other repository is repeatedly linked in the same discussions.

This week on Hacker News

Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 3:03:16 PM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by year9 dated mentions

Observed mentions: 2014-07-06 03:28:00 UTC to 2023-05-11 23:36:38 UTC.

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges

UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
Period	Start (UTC)	End (exclusive, UTC)	Mentions	Submissions	Comments
2014	2014-01-01 00:00:00 UTC	2015-01-01 00:00:00 UTC	1	0	1
2015	2015-01-01 00:00:00 UTC	2016-01-01 00:00:00 UTC	0	0	0
2016	2016-01-01 00:00:00 UTC	2017-01-01 00:00:00 UTC	1	0	1
2017	2017-01-01 00:00:00 UTC	2018-01-01 00:00:00 UTC	3	0	3
2018	2018-01-01 00:00:00 UTC	2019-01-01 00:00:00 UTC	2	1	1
2019	2019-01-01 00:00:00 UTC	2020-01-01 00:00:00 UTC	0	0	0
2020	2020-01-01 00:00:00 UTC	2021-01-01 00:00:00 UTC	1	0	1
2021	2021-01-01 00:00:00 UTC	2022-01-01 00:00:00 UTC	0	0	0
2022	2022-01-01 00:00:00 UTC	2023-01-01 00:00:00 UTC	0	0	0
2023	2023-01-01 00:00:00 UTC	2024-01-01 00:00:00 UTC	1	0	1

What Hacker News says

9 sources

anonacct37·May 11, 2023

In the old days I played with something like this: https://github.com/desaster/kippo But a more modern alternative seems to be the container based approach outlined here. https://lwn.net/Articles/848291/

In Session recording for Tailscale SSH in beta

geocrasher·Sep 16, 2020

I have to admit that I tried this and it was rather lackluster. Log output: https://pastebin.com/4FTHRF3f Not a lot of activity over the time I ran it, and I know that the port gets hit more than that. I had a much better time when I ran a honeypot with Kippo: https://github.com/desaster/kippo It was much more useful as it gave me a great list of IP's to block from all my systems ;)

In Endlessh: An SSH Tarpit

LinuxBender·Nov 9, 2018Submission

Kippo – SSH Honeypot

1 points · Open discussion

duskwuff·Oct 21, 2018

Eh, it depends on how it's exposed. I used to run a Kippo[1] honeypot on port 22. I'd regularly see automated intrusion attempts, often followed up by users manually interacting with the server (and slowly coming to realize that it was fake). Nowadays I expect the exploitation process is typically much more automatic, so it'd be less interesting to watch. [1]: https://github.com/desaster/kippo

In A honeypot programmed in Micropython for the ESP8266

iamnothere·Jul 7, 2017Recommendation phrase

I love the creativity here! Good "active defense" posture. (Too bad it didn't seem to stop Nikto scans.) Honeypots can be fun. I vaguely remember one that generated endless fake folders to bog down spiders. Edit: here's one for SSH, but the one I was thinking of was for web servers. https://github.com/desaster/kippo/blob/master/README.md

In [dead]

danesparza·Jul 6, 2017

This is similar to kippo or cowrie, SSH honeypots: https://github.com/desaster/kippo https://github.com/micheloosterhof/cowrie

In Defending a website with Zip bombs

teaearlgraycold·Feb 16, 2017

It's running kippo https://github.com/desaster/kippo

In GitHub commit search: “remove password”

watermoose·Sep 17, 2016

One of the answers mentioned: https://livesshattack.net/ On which there are leaderboards for password attempts: https://livesshattack.net/leaderboards A password that was tried 11633 times, almost as much as 11684 times that 'password' was tried is 'wubao'. That led me here: https://ewedaa.wordpress.com/2015/07/02/what-the-heck-is-wub... which indicated that this is one of the two first passwords used by sshPsycho when attempting a brute force attack. According to the poster these two passwords are tried often: > wubao = 誤報, means something wrongly reported > jiamima = 加密碼, can mean ‘add password’ or ‘encryption code’ Discussion about the use of kippo to log ssh login attempts: http://www.cubieforums.com/index.php?topic=3739.0 Kippo is available here: https://github.com/desaster/kippo

In Is your SSH password revealed when you attempt to connect to the wrong server?

duskwuff·Jul 6, 2014

Does this do anything after login, like Kippo does? https://github.com/desaster/kippo

In Show HN: Open source SSH honeypot with an API