# SSH

> SSH remote access protocol. Attackers target banners, auth methods, weak keys, legacy crypto, misconfigs, and CVEs, then pivot via agent forwarding, tunneling, and key reuse for persistence and exfil

- **URL:** https://hackindex.io/services/ssh
- **Type:** Service
- **Default ports:** 22
- **Tags:** ssh, remote-access, linux, network, authentication
- **Published:** 2025-12-31
- **Updated:** 2026-07-14

SSH (Secure Shell) runs on **TCP port 22** and provides encrypted remote access to systems. Nmap identifies it as `ssh`. Banner grabbing reveals the SSH server software and version, which helps narrow down the OS and potential vulnerabilities.

SSH itself is well-designed, but weak credentials, key reuse, and misconfigured access controls are frequent findings. Older versions of OpenSSH and Dropbear have known exploits. Passwordless root login or overly permissive `authorized_keys` files can give direct shell access.

Enumerate the server version, supported authentication methods, and key exchange algorithms. Try common credential pairs and check for username enumeration (CVE-2018-15473 in older OpenSSH). If keys are found elsewhere on the target, test them here.

## Phases

- [Enumeration](https://hackindex.io/services/ssh/enumeration.md): SSH banners, algorithms, auth methods, keys, and user enum guides (6 guides)
- [Vulnerability Discovery](https://hackindex.io/services/ssh/vulnerability-discovery.md): Guides on finding weak SSH configs and version-based CVEs (2 guides)
- [Exploitation](https://hackindex.io/services/ssh/exploitation.md): Guides for SSH auth attacks, key testing, and legacy crypto access (6 guides)
- [Post-Exploitation](https://hackindex.io/services/ssh/post-exploitation.md): SSH keys, agents, configs, and backdoor auditing guides (4 guides)
- [Lateral Movement](https://hackindex.io/services/ssh/lateral-movement.md): SSH pivoting via keys, agents, credential reuse, and tunneling (4 guides)
- [Persistence](https://hackindex.io/services/ssh/persistence.md): Guides on maintaining SSH access after initial compromise (1 guides)
- [Data Exfiltration](https://hackindex.io/services/ssh/data-exfiltration.md): SSH and SCP data transfer, tunneling, and timing tactics (2 guides)