Skip to content
HackIndex.io

SSH:

Exploitation

Guides for SSH auth attacks, key testing, and legacy crypto access

6 guides • Created Dec 28, 2025 • Updated Mar 29, 2026
6 guides

SSH Password Credential Attacks

Covers brute-forcing and credential stuffing SSH logins using tools like Hydra and Medusa to gain unauthorized shell access via weak or default passwords.

Jan 3, 2026 • 3 min read

SSH Terrapin Attack (CVE-2023-48795)

Exploiting the Terrapin attack to downgrade SSH session security by manipulating sequence numbers during handshake negotiation.

Mar 16, 2026 • 9 min read

SSH User Enumeration Exploitation

Exploit SSH user enumeration vulnerabilities to identify valid system accounts via timing attacks and response analysis, enabling targeted credential attacks.

Mar 16, 2026 • 3 min read

SSH exploitation converts enumeration findings into authenticated access. Credential brute-forcing with Hydra, nxc, or Medusa targets password authentication when it is enabled. Wordlists tuned to the target (usernames from enumeration, passwords from credential dumps or OSINT) dramatically improve success rates over generic lists.

Known CVEs provide direct exploitation paths when the version is vulnerable. libssh authentication bypass (CVE-2018-10933), OpenSSH user enumeration for targeted attacks, and older vulnerabilities in Dropbear or proprietary implementations all have public exploits. Private key reuse is another reliable vector: keys found on one host, in backups, or in code repositories often work on multiple systems.

Agent forwarding hijack is a post-auth technique that deserves mention here. If a user connects with agent forwarding enabled (-A), anyone with root on the intermediate host can use their forwarded keys to authenticate to other systems. This turns a single compromised host into a pivot point without ever touching a private key file.