SSH

SSH

SSH on TCP 22 provides encrypted remote administration, so it resists passive attack but exposes a rich active surface: service and user enumeration, password and key authentication attacks, weak-crypto negotiation and downgrade, host-key and certificate trust abuse for machine-in-the-middle, and tunnelling that turns a single SSH foothold into network pivoting.

1 phút đọccập nhật 7 thg 10, 2026

1 người đóng góp

SSH (Secure Shell) is an encrypted remote-administration protocol, commonly listening on TCP 22. Its assessment spans service identification, effective authentication policy, algorithm negotiation, host-key and certificate trust, implementation-specific vulnerabilities, and the forwarding capabilities available after authentication. A banner or advertised legacy algorithm is evidence for further review, not proof of patch status or a practical downgrade. Likewise, successful authentication may lead to a shell, a forced command, a subsystem, or restricted forwarding rather than unrestricted host control.

bash

# fingerprint the service
nmap -p22 -sV --script ssh2-enum-algos,ssh-hostkey <target>
# authentication-method review requires an explicit username and begins an auth exchange
nmap -p22 --script ssh-auth-methods --script-args 'ssh.user=<user>' <target>
nc <target> 22                                 # banner (SSH-2.0-OpenSSH_x.y)

Subtopics#

Enumeration: banner, algorithms, host keys, and version-specific user-enumeration checks.
Authentication: passwords, defaults, keys, and weak keys.
Weak cryptography: cipher, MAC, and key-exchange weaknesses.
MITM and trust: host-key and certificate trust abuse.
Tunneling: port forwarding, SOCKS, jump hosts, and agent hijacking.

Subtopics#

References#