OSCP+ Notes
  • 📙oscp+ notes
  • Reconnaissance
    • Discovery
      • DNS Hostname
      • Subdomain Discovery
      • Directory Discovery
    • Host Scan
      • Nmap
  • Enumeration
    • Services
      • FTP
      • SSH
  • Misc
    • SSH
    • RDP
    • File Transfer
    • Full Interactive Shell
    • Pivoting and Tunneling
Powered by GitBook
On this page
  • Manual
  • Nmap SSH Enumeration
  • Netexec
  • Resources
  1. Enumeration
  2. Services

SSH

PreviousFTPNextSSH

Last updated 6 months ago

Manual

ssh IP -p 22

Header

nc -nv IP 22

Nmap SSH Enumeration

Scripts

ls -lh /usr/share/nmap/scripts/ | grep ssh
nmap IP -p 22 -sV ssh-hostkey --script-args ssh_hostkey=full
nmap IP -p 22 -sV ssh-auth-methods --script-args="ssh.user=root"

Netexec

netexec ssh 172.21.0.0 -u user -p password/passwordfile --no-bruteforce
netexec ssh 172.21.0.0 -u user -p password/passwordfile --no-bruteforce -x whoami

Resources

SSH Audit - GitHub