Skip to content
HackIndex.io
SSH
Service

SSH

SSH remote access protocol. Attackers target banners, auth methods, weak keys, legacy crypto, misconfigs, and CVEs, then pivot via agent forwarding, tunneling, and key reuse for persistence and exfil

:22 25 guides 7 phases
1 min read Created: Dec 28, 2025 Updated: Jul 14, 2026

SSH (Secure Shell) runs on TCP port 22 and provides encrypted remote access to systems. Nmap identifies it as ssh. Banner grabbing reveals the SSH server software and version, which helps narrow down the OS and potential vulnerabilities.

SSH itself is well-designed, but weak credentials, key reuse, and misconfigured access controls are frequent findings. Older versions of OpenSSH and Dropbear have known exploits. Passwordless root login or overly permissive authorized_keys files can give direct shell access.

Enumerate the server version, supported authentication methods, and key exchange algorithms. Try common credential pairs and check for username enumeration (CVE-2018-15473 in older OpenSSH). If keys are found elsewhere on the target, test them here.

Enumeration

SSH banners, algorithms, auth methods, keys, and user enum guides

6

SSH User Enumeration

Detect valid system usernames via SSH timing attacks and error-based responses using tools like Metasploit, ssh-audit, and custom timing scripts.

Mar 16, 2026 • 2 min read

Vulnerability Discovery

Guides on finding weak SSH configs and version-based CVEs

2

Exploitation

Guides for SSH auth attacks, key testing, and legacy crypto access

6

SSH Password Credential Attacks

Covers brute-forcing and credential stuffing SSH logins using tools like Hydra and Medusa to gain unauthorized shell access via weak or default passwords.

Jan 3, 2026 • 3 min read

SSH Terrapin Attack (CVE-2023-48795)

Exploiting the Terrapin attack to downgrade SSH session security by manipulating sequence numbers during handshake negotiation.

Mar 16, 2026 • 9 min read

SSH User Enumeration Exploitation

Exploit SSH user enumeration vulnerabilities to identify valid system accounts via timing attacks and response analysis, enabling targeted credential attacks.

Mar 16, 2026 • 3 min read

Post-Exploitation

SSH keys, agents, configs, and backdoor auditing guides

4

Lateral Movement

SSH pivoting via keys, agents, credential reuse, and tunneling

4

SSH Credential Reuse Validation

Validates reused SSH credentials across internal hosts to identify lateral movement paths via password/key reuse in networked environments.

Jan 3, 2026 • 3 min read

SSH Lateral Movement with Harvested Keys

Techniques for moving laterally through networks using harvested SSH private keys, covering key discovery, agent hijacking, and hop chaining.

Mar 16, 2026 • 4 min read

Persistence

Guides on maintaining SSH access after initial compromise

1

SSH Persistence Techniques

Explores SSH-based persistence methods including authorized_keys manipulation, config backdoors, and rogue SSH daemons to maintain long-term access.

May 6, 2026 • 6 min read

Data Exfiltration

SSH and SCP data transfer, tunneling, and timing tactics

2