SSH:

Enumeration

SSH banners, algorithms, auth methods, keys, and user enum guides

6 guides • Created Dec 28, 2025 • Updated Mar 29, 2026

6 guides

SSH Algorithm Enumeration and Weak Crypto Detection

SSH Authentication Method Enumeration

SSH Client Flags for Fast Enumeration and Compatibility Checks

SSH Host Key Fingerprinting and Key Reuse

SSH User Enumeration

Detect valid system usernames via SSH timing attacks and error-based responses using tools like Metasploit, ssh-audit, and custom timing scripts.

SSH enumeration extracts server configuration details that shape every attack in later phases. Version detection from the banner string identifies the SSH implementation (OpenSSH, Dropbear, libssh) and its exact version, which maps directly to known vulnerabilities. Nmap's ssh2-enum-algos script dumps the full list of key exchange, cipher, MAC, and compression algorithms the server supports.

Authentication method enumeration tells you whether password, publickey, keyboard-interactive, or GSSAPI authentication is accepted. This determines whether brute-forcing is viable or if you need to hunt for keys. User enumeration timing attacks (CVE-2018-15473 and similar) work against specific OpenSSH versions and reveal valid usernames by measuring response time differences.

Tools like ssh-audit give you a complete security profile in a single run: deprecated algorithms, weak key sizes, and known CVE exposure. The enumeration data here feeds directly into vulnerability discovery and credential attacks.