Difference between this and cowrie?

[boredchilada]

Just discovered this project and im wondering what the differences are compared to cowrie?

[manfred-kaiser]

Comparison: Cowrie vs SSH-MITM

Feature	Cowrie (Honeypot)	SSH-MITM (MITM Tool)
Primary Purpose	Emulation of target systems for deception/logging	Interception of real SSH connections
Authentication Handling	Custom user table (static credentials)	Intercepts real authentication (password & pubkey)
Public Key Authentication	Not supported without workarounds	Fully supported and inspected
Port Forwarding	Only logs connection attempts	Actively intercepts and manipulates forwarded ports
MOSH Support	Not supported	Supported and intercepted
Connection Hijacking	Not supported	Can take over live SSH sessions
System Behavior	Fake shell, fake file system, controlled environment	Real-time relay to actual SSH servers
Use Case Focus	Cybersecurity research, deception, honeypots	Security testing, red teaming, traffic interception

Summary

• 🐄 Cowrie is best suited for honeypot deployments where emulation and attacker behavior logging are the goals.
• 🕵️ SSH-MITM is ideal for red teaming and advanced testing scenarios where live traffic interception, credential harvesting, and session takeover are needed.