SSH exposes an identification string before key exchange and advertises algorithm lists during negotiation. These can suggest an implementation, package lineage, and transport configuration, while host-key fingerprints help correlate endpoints. They do not prove patch status or a practical cryptographic attack. Authentication-method and username probes go further: they initiate authentication, are likely to be logged, and must use an explicit username. Username validation requires a documented implementation- and version-specific signal.
nmap -p22 -sV --script ssh2-enum-algos,ssh-hostkey <target>
# intrusive: begins authentication for the supplied identity
nmap -p22 --script ssh-auth-methods --script-args 'ssh.user=<user>' <target>
nc <target> 22 # raw banner
Subtopics#
- Banner grabbing: self-reported version and implementation hints.
- Algorithm enumeration: offered crypto and weak-option detection.
- User enumeration: version-specific account-disclosure behavior.