# Enumeration

> SSH banners, algorithms, auth methods, keys, and user enum guides

- **URL:** https://hackindex.io/services/ssh/enumeration
- **Service:** [SSH](https://hackindex.io/services/ssh.md)
- **Tags:** services, users, endpoints
- **Published:** 2026-01-03
- **Updated:** 2026-03-29

SSH enumeration extracts server configuration details that shape every attack in later phases. Version detection from the banner string identifies the SSH implementation (OpenSSH, Dropbear, libssh) and its exact version, which maps directly to known vulnerabilities. Nmap's ssh2-enum-algos script dumps the full list of key exchange, cipher, MAC, and compression algorithms the server supports.

Authentication method enumeration tells you whether password, publickey, keyboard-interactive, or GSSAPI authentication is accepted. This determines whether brute-forcing is viable or if you need to hunt for keys. User enumeration timing attacks (CVE-2018-15473 and similar) work against specific OpenSSH versions and reveal valid usernames by measuring response time differences.

Tools like ssh-audit give you a complete security profile in a single run: deprecated algorithms, weak key sizes, and known CVE exposure. The enumeration data here feeds directly into vulnerability discovery and credential attacks.

## Guides

- [SSH Algorithm Enumeration and Weak Crypto Detection](https://hackindex.io/services/ssh/enumeration/ssh-algorithm-enumeration-weak-crypto.md)
- [SSH Authentication Method Enumeration](https://hackindex.io/services/ssh/enumeration/ssh-authentication-method-enumeration.md)
- [SSH Banner and Version Enumeration](https://hackindex.io/services/ssh/enumeration/ssh-banner-version-enumeration.md)
- [SSH Client Flags for Fast Enumeration and Compatibility Checks](https://hackindex.io/services/ssh/enumeration/ssh-client-flags-for-enumeration.md)
- [SSH Host Key Fingerprinting and Key Reuse](https://hackindex.io/services/ssh/enumeration/ssh-hostkey-fingerprinting-key-reuse.md)
- [SSH User Enumeration](https://hackindex.io/services/ssh/enumeration/ssh-user-enumeration.md): Detect valid system usernames via SSH timing attacks and error-based responses using tools like Metasploit, ssh-audit, and custom timing scripts.