CowrieSniffer: Extensão do Honeypot Cowrie para coleta e monitoramento de URLs

Abstract

This work presents the development of CowrieSniffer, a tool for analyzing and monitoring addresses captured by the Cowrie Honeypot. The system aims to verify the availability of URLs used by attackers, which contributes to threat analysis and the improvement of cybersecurity. The developed tool collects URLs stored in the downloads and input tables of Cowrie's database, transferring them to a specific monitoring database. Then, the tool periodically checks the availability of these addresses and updates the urls table in the monitoring database according to changes in the availability of the identified URLs. The implementation was carried out using Python, due to its versatility and ease in data manipulation, as well as Docker to ensure environment portability and MySQL for storing the collected information. The tests performed demonstrated that the tool is capable of processing information efficiently, which enables the analysis of persistence and lifetime of URLs used by attackers. The results obtained during the proposed experiments validated the system's effectiveness.