pentesting-ssh

name	pentesting-ssh
description	Testing SSH services (default port 22) for weak algorithms/host keys, default and brute-forceable credentials, key-based auth gaps, SFTP shell escapes and tunneling, auth-method downgrade, and high-impact CVEs (regreSSHion CVE-2024-6387, XZ backdoor CVE-2024-3094, Erlang/OTP CVE-2025-32433, libssh CVE-2018-10933) during authorized engagements.
domain	cybersecurity
subdomain	network-services-pentesting
tags	["penetration-testing","network-services","ssh"]
version	1.0
author	xalgorix
license	Apache-2.0

Pentesting SSH (port 22)

When to Use

• Default port 22/tcp; management/embedded services may expose SSH/Erlang-OTP on 2022, 830, 2222.
• When nmap/banner shows ssh, OpenSSH, Dropbear, libssh, wolfSSH, or an SSH-2.0-* banner.
• For auditing crypto posture, authentication configuration, key trust, and known daemon vulnerabilities.

Quick Enumeration

# Banner grab
nc -vn <IP> 22

# Host key fingerprint
ssh-keyscan -t rsa,ecdsa,ed25519 <IP> -p 22

# nmap version + scripts
nmap -p22 <IP> -sV                                   # version
nmap -p22 <IP> -sC                                   # default scripts
nmap -p22 <IP> --script ssh2-enum-algos              # supported algorithms
nmap -p22 <IP> --script ssh-hostkey --script-args ssh_hostkey=full   # weak keys
nmap -p22 <IP> --script ssh-auth-methods --script-args="ssh.user=root"  # auth methods

# Full crypto/config audit (algorithms, CVEs, recommendations)
python3 ssh-audit.py <IP>

Critical: Checks Most Often Missed

• Auth-method downgrade — strong methods enabled without disabling password. Verbose mode reveals weaker methods still offered.
  • How to CONFIRM:

    ssh -v <IP>     # look for: "Authentications that can continue: publickey,password,keyboard-interactive"
    ssh -v <IP> -o PreferredAuthentications=password   # force the weak method
    

• Default / known credentials — vendor defaults are common on appliances (see table). Also try SecLists ssh-betterdefaultpasslist.txt.
  • How to CONFIRM: hydra -l <user> -P creds.txt -t 4 ssh://<IP>.
• Weak / leaked host & user keys — Debian weak-PRNG keys (g0tmi1k/debian-ssh) and rapid7 ssh-badkeys can be bruteforced/accepted.