Skip to content
HackIndex logo

HackIndex

SSH Client Flags for Fast Enumeration and Compatibility Checks

3 min read Jan 4, 2026

Use SSH client options to keep enumeration reproducible, non-interactive, and useful for confirming legacy crypto acceptance.

Clean connects for noisy environments

If you are hitting many ephemeral targets and host keys are not valuable, disabling checks removes friction. In real work, use this deliberately because it discards host key signal and makes MITM harder to notice.

┌──(kali㉿kali)-[~]
└─$ ssh -p $PORT -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null $USERNAME@$TARGET_IP

When you only want a quick “does it respond” probe without hanging on prompts, force BatchMode and a short timeout.

┌──(kali㉿kali)-[~]
└─$ ssh -p $PORT -o BatchMode=yes -o ConnectTimeout=5 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null $USERNAME@$TARGET_IP exit

Verbose handshake for negotiation details

-vvv is the fastest way to see why your client and the server do not agree. This is where you confirm what auth methods are offered, which KEX and host key algorithms were selected, whether the server rejects modern defaults, and why it disconnects.

┌──(kali㉿kali)-[~]
└─$ ssh -vvv -p $PORT -o BatchMode=yes $USERNAME@$TARGET_IP exit

Two common error patterns that tell you to move into legacy forcing:

no matching key exchange method found
no matching host key type found

Legacy cipher acceptance checks

If you already saw CBC in ssh2-enum-algos, confirming acceptance with a forced cipher is a clean way to document it without guessing.

┌──(kali㉿kali)-[~]
└─$ ssh -p $PORT -c aes128-cbc $USERNAME@$TARGET_IP

You can also validate legacy host key acceptance when you suspect old ssh-rsa dependencies. This stays enumeration as long as you are only proving what the target will negotiate.

┌──(kali㉿kali)-[~]
└─$ ssh -p $PORT -o HostKeyAlgorithms=+ssh-rsa -o PubkeyAcceptedAlgorithms=+ssh-rsa $USERNAME@$TARGET_IP

Combined legacy KEX and ssh-rsa acceptance

Some targets only become reachable when you force both the KEX and the host key algorithms together. This is common on older appliances and badly hardened SSH stacks.

┌──(kali㉿kali)-[~]
└─$ ssh -p $PORT -o KexAlgorithms=+diffie-hellman-group1-sha1 -o HostKeyAlgorithms=+ssh-rsa -o PubkeyAcceptedAlgorithms=+ssh-rsa $USERNAME@$TARGET_IP

If you only want proof of acceptance without an interactive session:

┌──(kali㉿kali)-[~]
└─$ ssh -p $PORT -o BatchMode=yes -o KexAlgorithms=+diffie-hellman-group1-sha1 -o HostKeyAlgorithms=+ssh-rsa -o PubkeyAcceptedAlgorithms=+ssh-rsa $USERNAME@$TARGET_IP exit

If you need to confirm group1 acceptance because it appeared in algorithm enumeration, force it alone and note whether the server negotiates it.

┌──(kali㉿kali)-[~]
└─$ ssh -p $PORT -o KexAlgorithms=+diffie-hellman-group1-sha1 $USERNAME@$TARGET_IP

References