SSH:
Lateral Movement
SSH pivoting via keys, agents, credential reuse, and tunneling
SSH Credential Reuse Validation
Validates reused SSH credentials across internal hosts to identify lateral movement paths via password/key reuse in networked environments.
SSH Lateral Movement with Harvested Keys
Techniques for moving laterally through networks using harvested SSH private keys, covering key discovery, agent hijacking, and hop chaining.
SSH is the primary lateral movement protocol in Linux and Unix environments. Key-based pivoting works when private keys found on a compromised host are accepted by other systems. Check ~/.ssh/ directories for id_rsa, id_ed25519, and any non-standard key files, then test them against hosts listed in known_hosts and SSH configs.
Agent forwarding abuse lets you use a connected user's keys without ever reading them from disk. If someone connects to your compromised host with ssh -A, their agent socket is available to root. ProxyJump (-J) and ProxyCommand chaining create multi-hop paths through environments where direct connectivity between segments does not exist.
Credential reuse is the simplest vector: passwords or keys that work on one host frequently work on others, especially in environments with shared service accounts or configuration management that distributes the same authorized_keys file. Each new host you reach expands both your credential collection and your network visibility for the next hop.