# SSH Banner and Version Enumeration

- **URL:** https://hackindex.io/services/ssh/enumeration/ssh-banner-version-enumeration
- **Path:** SSH > Enumeration
- **Up:** [Enumeration](https://hackindex.io/services/ssh/enumeration.md)
- **Published:** 2026-01-03
- **Updated:** 2026-01-04

Capture the SSH banner and product signal fast so you can choose the right follow-up checks and stop guessing.

## What to capture

For SSH, the minimum you want in notes is the raw banner line and what Nmap thinks the service is. That gives you quick pivots:

Old OpenSSH strings can justify deeper scrutiny, but treat them as a hint, not proof. Distros backport fixes while keeping older version strings. Embedded stacks like Dropbear and vendor SSH daemons often correlate with weaker defaults and odd behavior.

If SSH is running on a non-standard port, do the same work. The port number is not interesting by itself, but it is useful for reporting and for spotting management interfaces.

## SSH Daemon Fingerprinting with Nmap

This is the baseline. If your port is correct, it is usually enough to get a clean “OpenSSH vs Dropbear vs appliance” answer.

```bash
nmap -sV -p $PORT $TARGET_IP
# PORT   STATE SERVICE VERSION
# 22/tcp open  ssh     OpenSSH 7.2p2 Ubuntu 4ubuntu2.10 (Ubuntu Linux; protocol 2.0)
#
```

If Nmap prints `protocol 1.99` or anything that suggests SSHv1 compatibility, keep that and jump to SSHv1 checks in your algorithm page.

When you need more aggressive fingerprinting because the banner is generic:

```bash
nmap -sV --version-all -p $PORT $TARGET_IP
```

## Raw banner grab without SSH client behavior

Nmap can be wrong or conservative. A raw read shows what the server actually emits.

```bash
nc -nv $TARGET_IP $PORT
# (UNKNOWN) [$TARGET_IP] 2222 (ssh) open
# SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u1
#
```

If the banner is missing, delayed, or weirdly formatted, that itself is a signal. Some appliances and proxies behave like that.

## Confirm handshake behavior with verbose SSH

This is useful when you want to see how the server reacts to a real SSH client without doing an interactive login. `BatchMode` avoids password prompts and keeps it clean.

```bash
ssh -vvv -p $PORT -o BatchMode=yes -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null $USERNAME@$TARGET_IP exit
```

What you look for in verbose output:

- the server banner line
- early disconnect reasons
- whether the server advertises unusual extensions
- whether you get obvious policy failures like “no matching key exchange method” which often indicates legacy-only configs

## References

- [Nmap Version Detection](https://nmap.org/book/man-version-detection.html) - How -sV fingerprints services and versions.
- [nc(1) Manual Page](https://man.openbsd.org/nc) - Simple banner reads without SSH client negotiation.
- [ssh(1) Manual Page](https://man.openbsd.org/ssh) - Client flags for verbose, non-interactive handshake checks.