Conduct comprehensive SSH security assessments including enumeration, credential attacks, vulnerability exploitation, tunneling techniques, and post-exploitation activities. This skill covers the complete methodology for testing SSH service security.

⚠️ AUTHORIZED USE ONLY This skill is for educational purposes or authorized security assessments only. You must have explicit, written permission from the system owner before using this tool. Misuse of this tool is illegal and strictly prohibited. Mandatory confirmation gate Before any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target, ask for the exact target URL, IP, account, or resource and confirmation of written authorization and permitted scope. Show the exact command(s), explain their expected effect, and wait for explicit confirmation in the current conversation. Without that confirmation, remain read only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab. SSH Penetration Testing Purpose Conduct comprehensive SSH security assessments including enumeration, credential attacks, vulnerability exploitation, tunneling techniques, and post exploitation activities. This skill covers the complete methodology for testing SSH service security. Prerequisites Required Tools Nmap with SSH scripts Hydra or Medusa for brute forcing ssh audit for configuration analysis Metasploit Framework Python with Paramiko library Required Knowledge SSH protocol fundamentals Public/private key authentication Port forwarding concepts Linux command line proficiency Outputs and Deliverables 1. SSH Enumeration Report Versions, algorithms, configurations 2. Credential Assessment Weak passwords, default credentials 3. Vulnerability Assessment Known CVEs, misconfigurations 4. Tunnel Documentation Port forwarding configurations Core Workflow Phase 1: SSH Service Discovery Identify SSH services on target networks: Phase 2: SSH Enumeration Gather detailed information about SSH services: Phase 3: SSH Configuration Auditing Identify weak configurations: Key configuration weaknesses to identify: Weak key exchange algorithms (diffie hellman group1 sha1) Weak ciphers (arcfour, 3des cbc) Weak MACs (hmac md5, hmac sha1 96) Deprecated protocol versions Phase 4: Credential Attacks Brute Force with Hydra Brute Force with Medusa Password Spraying Phase 5: Key Based Authentication Testing Test for weak or exposed keys: Check for exposed keys: Phase 6: Vulnerability Exploitation Search for known vulnerabilities: Phase 7: SSH Tunneling and Port Forwarding Local Port Forwarding Forward local port to remote service: Remote Port Forwarding Expose local service to remote network: Dynamic Port Forwarding (SOCKS Proxy) Create SOCKS proxy for network pivoting: ProxyJump (Jump Hosts) Chain through multiple SSH servers: Phase 8: Post Exploitation Activities after gaining SSH access: Phase 9: Custom SSH Scripts with Paramiko Python based SSH automation: Phase 10: Metasploit SSH Modules Use Metasploit for comprehensive SSH testing: Quick Reference SSH Enumeration Commands Command Purpose nc <host 22 Banner grabbing ssh audit <host Configuration audit nmap script ssh SSH NSE scripts searchsploit openssh Find exploits Brute Force Options Tool Command Hydra hydra l user P pass.txt ssh://host Medusa medusa h host u user P pass.txt M ssh Ncrack ncrack p 22 user admin P pass.txt host Metasploit use auxiliary/scanner/ssh/ssh login Port Forwarding Types Type Command Use Case Local L 8080:target:80 Access remote services locally Remote R 8080:localhost:80 Expose local services remotely Dynamic D 1080 SOCKS proxy for pivoting Common SSH Ports Port Description 22 Default SSH 2222 Common alternate 22222 Another alternate 830 NETCONF over SSH Constraints and Limitations Legal Considerations Always obtain written authorization Brute forcing may violate ToS Document all testing activities Technical Limitations Rate limiting may block attacks Fail2ban or similar may ban IPs Key based auth prevents password attacks Two factor authentication adds complexity Evasion Techniques Use slow brute force: t 1 w 5 Distribute attacks across IPs Use timing based enumeration carefully Respect lockout thresholds Troubleshooting Issue Solutions Connection Refused Verify SSH running; check firewall; confirm port; test from different IP Authentication Failures Verify username; check password policy; key permissions (600); authorized keys format Tunnel Not Working Check GatewayPorts/AllowTcpForwarding in sshd config; verify firewall; use ssh v When to Use This skill is applicable to execute the workflow or actions described in the overview.

ssh-penetration-testing