SSH Banner and Version Enumeration

Capture the SSH banner and product signal fast so you can choose the right follow-up checks and stop guessing.

What to capture

For SSH, the minimum you want in notes is the raw banner line and what Nmap thinks the service is. That gives you quick pivots:

Old OpenSSH strings can justify deeper scrutiny, but treat them as a hint, not proof. Distros backport fixes while keeping older version strings. Embedded stacks like Dropbear and vendor SSH daemons often correlate with weaker defaults and odd behavior.

If SSH is running on a non-standard port, do the same work. The port number is not interesting by itself, but it is useful for reporting and for spotting management interfaces.

Banner and product signal with Nmap

This is the baseline. If your port is correct, it is usually enough to get a clean “OpenSSH vs Dropbear vs appliance” answer.

If Nmap prints protocol 1.99 or anything that suggests SSHv1 compatibility, keep that and jump to SSHv1 checks in your algorithm page.

When you need more aggressive fingerprinting because the banner is generic:

Raw banner grab without SSH client behavior

Nmap can be wrong or conservative. A raw read shows what the server actually emits.

If the banner is missing, delayed, or weirdly formatted, that itself is a signal. Some appliances and proxies behave like that.

Confirm handshake behavior with verbose SSH

This is useful when you want to see how the server reacts to a real SSH client without doing an interactive login. BatchMode avoids password prompts and keeps it clean.

What you look for in verbose output:

• the server banner line

• early disconnect reasons

• whether the server advertises unusual extensions

• whether you get obvious policy failures like “no matching key exchange method” which often indicates legacy-only configs