# SSH Host Key Fingerprinting and Key Reuse

- **URL:** https://hackindex.io/services/ssh/enumeration/ssh-hostkey-fingerprinting-key-reuse
- **Path:** SSH > Enumeration
- **Up:** [Enumeration](https://hackindex.io/services/ssh/enumeration.md)
- **Published:** 2026-01-03
- **Updated:** 2026-01-04

Extract and fingerprint SSH host keys to correlate systems, detect cloned infrastructure, and spot weak key posture.

## What this gives you in practice

Banners change, IPs change, DNS changes. Host keys often do not. Host key fingerprints are useful for:

- correlating “same box, different IP”
- spotting golden images and cloned VMs
- catching appliances shipped with shared keys
- sanity-checking a “new” banner that comes with old key material

If you find the same host key across multiple targets, that is usually a fleet issue, not an isolated host issue.

## Fingerprint host keys with Nmap

This is the cleanest method when you are already scanning with Nmap.

```bash
nmap -p $PORT --script ssh-hostkey $TARGET_IP
# Post-scan script results:
# | ssh-hostkey: Possible duplicate hosts
# | Key 1024 60:ac:4d:51:b1:cd:85:09:12:16:92:76:1d:5d:27:6e (DSA) used by:
# |   192.168.1.1
# |   192.168.1.2
# | Key 2048 2c:22:75:60:4b:c3:3b:18:a2:97:2c:96:7e:28:dc:dd (RSA) used by:
# |   192.168.1.1
# |_  192.168.1.2
```

If you see RSA keys at 1024 or unusual legacy key types, that is usually worth a specific note.

## Pull host keys without Nmap using ssh-keyscan

`ssh-keyscan` is good when you want to script fingerprint collection without scanning the whole host.

```bash
ssh-keyscan -p $PORT -T 5 $TARGET_IP 2>/dev/null
```

If you want a fingerprint directly from that output:

```bash
ssh-keyscan -p $PORT -T 5 $TARGET_IP 2>/dev/null | ssh-keygen -lf -
```

## Find duplicate host keys across a target list

This is where fingerprints become operationally useful. If multiple hosts share the same key, you will see it immediately.

```bash
while read -r ip; do
  ssh-keyscan -p $PORT -T 3 "$ip" 2>/dev/null
done < targets.txt | ssh-keygen -lf - | sort | uniq -c | sort -nr | head
```

If the `uniq -c` count is greater than 1 for the same fingerprint, you have key reuse. That is a real finding and often indicates poor image hygiene or appliance defaults.

## References

- [Nmap NSE ssh-hostkey](https://nmap.org/nsedoc/scripts/ssh-hostkey.html) - Extracts SSH host key fingerprints and can help correlate duplicate keys.
- [ssh-keyscan(1) Manual Page](https://man.openbsd.org/ssh-keyscan) - Retrieves public host keys without interactive authentication.
- [ssh-keygen(1) Manual Page](https://man.openbsd.org/ssh-keygen) - Fingerprinting and key inspection with -l and -f.