Enumeration

SSH enumeration gathers what directs every later attack: the version banner that identifies the implementation and its vulnerabilities, the offered algorithms that reveal weak-crypto exposure, the host-key fingerprint, and valid usernames. None requires authentication, and the results select which authentication, crypto, or exploit path applies.

1 min di letturaaggiornato il 7 ott 2026

1 contributore

SSH exposes an identification string before key exchange and advertises algorithm lists during negotiation. These can suggest an implementation, package lineage, and transport configuration, while host-key fingerprints help correlate endpoints. They do not prove patch status or a practical cryptographic attack. Authentication-method and username probes go further: they initiate authentication, are likely to be logged, and must use an explicit username. Username validation requires a documented implementation- and version-specific signal.

bash

nmap -p22 -sV --script ssh2-enum-algos,ssh-hostkey <target>
# intrusive: begins authentication for the supplied identity
nmap -p22 --script ssh-auth-methods --script-args 'ssh.user=<user>' <target>
nc <target> 22                                 # raw banner

Subtopics#

Banner grabbing: self-reported version and implementation hints.
Algorithm enumeration: offered crypto and weak-option detection.
User enumeration: version-specific account-disclosure behavior.

Enumeration

Subtopics#

References#