Skip to content
HackIndex logo

HackIndex

SSH Host Key Fingerprinting and Key Reuse

2 min read Jan 4, 2026

Extract and fingerprint SSH host keys to correlate systems, detect cloned infrastructure, and spot weak key posture.

What this gives you in practice

Banners change, IPs change, DNS changes. Host keys often do not. Host key fingerprints are useful for:

  • correlating “same box, different IP”

  • spotting golden images and cloned VMs

  • catching appliances shipped with shared keys

  • sanity-checking a “new” banner that comes with old key material

If you find the same host key across multiple targets, that is usually a fleet issue, not an isolated host issue.

Fingerprint host keys with Nmap

This is the cleanest method when you are already scanning with Nmap.

┌──(kali㉿kali)-[~]
└─$ nmap -p $PORT --script ssh-hostkey $TARGET_IP 
Post-scan script results:
| ssh-hostkey: Possible duplicate hosts
| Key 1024 60:ac:4d:51:b1:cd:85:09:12:16:92:76:1d:5d:27:6e (DSA) used by:
|   192.168.1.1
|   192.168.1.2
| Key 2048 2c:22:75:60:4b:c3:3b:18:a2:97:2c:96:7e:28:dc:dd (RSA) used by:
|   192.168.1.1
|_  192.168.1.2

If you see RSA keys at 1024 or unusual legacy key types, that is usually worth a specific note.

Pull host keys without Nmap using ssh-keyscan

ssh-keyscan is good when you want to script fingerprint collection without scanning the whole host.

┌──(kali㉿kali)-[~]
└─$ ssh-keyscan -p $PORT -T 5 $TARGET_IP 2>/dev/null

If you want a fingerprint directly from that output:

┌──(kali㉿kali)-[~]
└─$ ssh-keyscan -p $PORT -T 5 $TARGET_IP 2>/dev/null | ssh-keygen -lf -

Find duplicate host keys across a target list

This is where fingerprints become operationally useful. If multiple hosts share the same key, you will see it immediately.

while read -r ip; do
  ssh-keyscan -p $PORT -T 3 "$ip" 2>/dev/null
done < targets.txt | ssh-keygen -lf - | sort | uniq -c | sort -nr | head

If the uniq -c count is greater than 1 for the same fingerprint, you have key reuse. That is a real finding and often indicates poor image hygiene or appliance defaults.

References