Skip to content
Home

SSH enumeration

Version/algorithm fingerprinting, user enumeration, and brute-forcing on SSH servers.

bash·1 min read··INE Certification

SSH is deliberately narrow from an attacker’s side: there’s no anonymous mode, so it comes down to either finding a vulnerable version or brute-forcing valid credentials. Default port is 22.

nc <target_ip> 22                    # grab the banner
ssh <user>@<target_ip>               # basic login attempt

Nmap

nmap -sV <target_ip>                                                          # identify version
nmap --script ssh2-enum-algos <target_ip>                                     # supported algorithms
nmap --script ssh-hostkey --script-args ssh_hostkey=full <target_ip>          # full host key
nmap --script ssh-auth-methods --script-args="ssh.user=<user>" <target_ip>    # supported auth methods
nmap -p22 --script=ssh-brute --script-args userdb=<userdb_file> <target_ip>
nmap --script=ssh-run --script-args="ssh-run.cmd=<cmd>,ssh-run.username=<u>,ssh-run.password=<p>" <target_ip>

Metasploit

auxiliary/scanner/ssh/ssh_version
auxiliary/scanner/ssh/ssh_enumusers
auxiliary/scanner/ssh/ssh_login       # brute-force with username/password

Brute-force

hydra -L users.txt -P passwords.txt <target_ip> ssh

Once valid credentials or a key are found, we have access to the system and need no further exploitation. Go straight to privilege escalation or post-exploitation.