> For the complete documentation index, see [llms.txt](https://alexanderbittner.gitbook.io/pentest-resources/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://alexanderbittner.gitbook.io/pentest-resources/vulnerability-analysis/standard-ports-and-common-services/22-ssh.md).

# 22 - SSH

Modern ssh servers are usually quite hardened, but check for older versions!

### Banner grabbing with netcat:

```bash
nc <ip-addr> 22
```

### Nmap scripts

#### Enumerate authentication methods:

`nmap -p 22 --script ssh-auth-methods --script-args="ssh.user="`&#x20;

#### Brute-force accounts

`nmap -p 22 --script ssh-brute --script-args userdb=users.lst,passdb=pass.lst  --script-args ssh-brute.timeout=4s`&#x20;

#### Enumerate authentication algorithms

`nmap --script ssh2-enum-algos target`

#### Enumerate SSH host keys (3 examples)

* `"full"`: The entire key, not just the fingerprint
* `"bubble"`: Bubble Babble output
* `"visual"`: Visual ASCII art representation
* `"all"`: All of the above

`nmap host --script ssh-hostkey --script-args ssh_hostkey=full`
\
`nmap host --script ssh-hostkey --script-args ssh_hostkey=all`
\
`nmap host --script ssh-hostkey --script-args ssh_hostkey='visual bubble'`