Skip to main content
Default Port: 22 SSH is the most common remote access protocol on Linux and network infrastructure, and because it’s everywhere, it’s also one of the first things worth checking for weak credentials, reused keys, and version-specific vulnerabilities. Once you’re in, it doubles as one of the best pivoting tools available, port forwarding and tunneling are built in, no extra software needed.

Password Authentication

Standard username and password. Straightforward to brute-force if rate limiting and lockout aren’t configured.

Key-Based Authentication

A private key stands in for a password. Far more resistant to brute-forcing, but a weak passphrase or a leaked key changes that completely.
SSH is also one of the best pivoting tools you’ll use. See the Pivoting & Port Forwarding page for local, dynamic, and remote forwarding in depth, this page covers SSH-specific enumeration and attacks only.

​
Connecting

If a server offers key-based auth but you only have a password, SSH may try key auth first and fail silently. Force password authentication explicitly:

​
Recon

ssh-audit goes well beyond a version banner, it reports supported algorithms, known weaknesses, and concrete hardening recommendations in one pass:
Checking which authentication methods a server actually offers narrows down your approach before attempting anything:

​
Username Enumeration

OpenSSH through 7.7 (CVE-2018-15473) has a timing/response difference between valid and invalid usernames during authentication, letting you enumerate valid accounts without ever completing a login.

​
Brute Forcing

​
Attacking SSH Keys

If you recover a private key (from a backup, a misconfigured share, or a compromised host) and it’s passphrase-protected, it’s crackable offline just like any other credential.
Always check a recovered private key’s file permissions and any matching authorized_keys on a host you already have access to. A key alone is only half the picture, confirm which account and which host it’s actually meant to unlock.

​
Known Vulnerabilities

libssh_auth_bypass targets CVE-2018-10933, a flaw letting an attacker skip authentication entirely on affected libssh server versions (not OpenSSH itself). A positive result is a critical, no-credentials-needed finding.

​
Post-Exploitation: Persistence

Appending your own key to authorized_keys is a lightweight but detectable persistence method. Confirm it’s in scope and remove it during cleanup.

​
Post-Exploitation: File Transfer

​
Quick Reference Tools

Hackviser: SSH

Quick-reference pentesting guide for the SSH service.

HackTricks: SSH

Deeper breakdown of SSH enumeration and exploitation techniques.

ssh-audit

Automated SSH configuration and algorithm auditing.
Key-based persistence and credential brute-forcing are both easily logged, high-impact actions. Confirm scope before going beyond version fingerprinting and authorized credential testing.