Skip to content

SSH Enumeration Tools

TheGetch edited this page Jan 5, 2021 · 1 revision

SSH Enumeration Tools

SSH Enumeration Tools

Nmap Enumeration

$ ls -lh /usr/share/nmap/scripts/ | grep ssh
-rw-r--r-- 1 root root 5.3K Oct 12 09:29 ssh2-enum-algos.nse
-rw-r--r-- 1 root root 1.2K Oct 12 09:29 ssh-auth-methods.nse
-rw-r--r-- 1 root root 3.0K Oct 12 09:29 ssh-brute.nse
-rw-r--r-- 1 root root  16K Oct 12 09:29 ssh-hostkey.nse
-rw-r--r-- 1 root root 5.9K Oct 12 09:29 ssh-publickey-acceptance.nse
-rw-r--r-- 1 root root 3.7K Oct 12 09:29 ssh-run.nse
-rw-r--r-- 1 root root 1.4K Oct 12 09:29 sshv1.nse
$ nmap x.x.x.x -p 22 -sV --script=exampleScript1.nse,exampleScript2.nse

Manual Connection

$ nc -nv x.x.x.X 22 # Might give header
$ ssh x.x.x.x -p22

_Sidebar

1. Recon

Ping Sweep

CIDR to IP

2. Enumeration

Services

05. HTTP (80,443,8080,8443,etc.)

3. Exploitation

4. Post Exploiation

5. High Value Information

Hashes

6. Reporting

7. Random Notes/Useful Tidbits

Clone this wiki locally