SSH

SSH provides encrypted remote administration, commonly on TCP 22. Assess service identity, effective authentication policy, negotiated algorithms, host and certificate trust, implementation-specific advisories, and the forwarding capabilities granted after access.

1 min leximpërditësuar më 21 tet 2026florianamette1 kontribues
Pyetni asistentin tuaj (MCP)Redakto në GitHub

SSH (Secure Shell) is an encrypted remote-administration protocol, commonly listening on TCP 22. Its assessment spans service identification, effective authentication policy, algorithm negotiation, host-key and certificate trust, implementation-specific vulnerabilities, and the forwarding capabilities available after authentication. A banner or advertised legacy algorithm is evidence for further review, not proof of patch status or a practical downgrade. Likewise, successful authentication may lead to a shell, a forced command, a subsystem, or restricted forwarding rather than unrestricted host control.

bash
# fingerprint the service
nmap -p22 -sV --script ssh2-enum-algos,ssh-hostkey <target>
# authentication-method review requires an explicit username and begins an auth exchange
nmap -p22 --script ssh-auth-methods --script-args 'ssh.user=<user>' <target>
nc <target> 22                                 # banner (SSH-2.0-OpenSSH_x.y)

Subtopics#

  • Enumeration: banner, algorithms, host keys, and version-specific user-enumeration checks.
  • Authentication: passwords, defaults, keys, and weak keys.
  • Weak cryptography: cipher, MAC, and key-exchange weaknesses.
  • MITM and trust: host-key and certificate trust abuse.
  • Tunneling: port forwarding, SOCKS, jump hosts, and agent hijacking.

References#

E mëparshmjaSession shadowingTjetra Authentication