SSH

SSH on TCP 22 provides encrypted remote administration, so it resists passive attack but exposes a rich active surface: service and user enumeration, password and key authentication attacks, weak-crypto negotiation and downgrade, host-key and certificate trust abuse for machine-in-the-middle, and tunnelling that turns a single SSH foothold into network pivoting.

1 ನಿಮಿಷದ ಓದುಅಕ್ಟೋ 7,2026 ರಂದು ನವೀಕರಿಸಲಾಗಿದೆflorianamette1 ಕೊಡುಗೆದಾರ
ನಿಮ್ಮ ಸಹಾಯಕವನ್ನು ಕೇಳಿ (MCP)GitHub ನಲ್ಲಿ ಸಂಪಾದಿಸಿ

SSH (Secure Shell) is an encrypted remote-administration protocol, commonly listening on TCP 22. Its assessment spans service identification, effective authentication policy, algorithm negotiation, host-key and certificate trust, implementation-specific vulnerabilities, and the forwarding capabilities available after authentication. A banner or advertised legacy algorithm is evidence for further review, not proof of patch status or a practical downgrade. Likewise, successful authentication may lead to a shell, a forced command, a subsystem, or restricted forwarding rather than unrestricted host control.

bash
# fingerprint the service
nmap -p22 -sV --script ssh2-enum-algos,ssh-hostkey <target>
# authentication-method review requires an explicit username and begins an auth exchange
nmap -p22 --script ssh-auth-methods --script-args 'ssh.user=<user>' <target>
nc <target> 22                                 # banner (SSH-2.0-OpenSSH_x.y)

Subtopics#

  • Enumeration: banner, algorithms, host keys, and version-specific user-enumeration checks.
  • Authentication: passwords, defaults, keys, and weak keys.
  • Weak cryptography: cipher, MAC, and key-exchange weaknesses.
  • MITM and trust: host-key and certificate trust abuse.
  • Tunneling: port forwarding, SOCKS, jump hosts, and agent hijacking.

References#

ಹಿಂದಿನದುSession shadowingಮುಂದಿನದು Authentication