skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

pentesting-ssh

Tests SSH services for weak algorithms, default credentials, auth downgrades, and known CVEs.

954|172|Updated Mar 13, 2026
Search Tags:#penetration testing#ssh#brute force#Nmap#network services#Security audit#CVE triage
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill pentesting-ssh
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: pentesting-ssh
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/network-services-pentesting/pentesting-ssh
Command: npx skills add https://github.com/xalgord/xalgorix --skill pentesting-ssh

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Auditing SSH services during authorized penetration tests requires checking many attack surfaces—weak crypto, default credentials, key trust issues, SFTP escapes, and high-impact CVEs—and testers often miss critical checks like auth-method downgrades or banner-based false negatives.

Core Features & Use Cases

  • Structured Enumeration Workflow: Guides banner grabbing, host key fingerprinting, algorithm auditing with nmap NSE scripts and ssh-audit, and auth-method discovery.
  • Authentication Testing: Covers default vendor credentials, hydra/netexec brute forcing, weak Debian PRNG keys, and Kerberos/GSSAPI login paths.
  • Exploitation & Triage: Documents SFTP shell escapes, tunneling, and confirmation steps for regreSSHion (CVE-2024-6387), the XZ backdoor (CVE-2024-3094), Erlang/OTP (CVE-2025-32433), and libssh (CVE-2018-10933).
  • Use Case: During an authorized engagement, nmap shows OpenSSH 9.2p1 on port 22; follow the workflow to confirm password authentication is still enabled, brute-force a weak deploy account, and produce a standardized finding report with evidence and remediation.

Quick Start

Ask the agent to enumerate and audit the SSH service on the authorized target at the given IP address and report any weak authentication or known CVE exposure.

Frequently Asked Questions about pentesting-ssh

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I enumerate SSH algorithms and auth methods with nmap?▼

Use nmap NSE scripts: ssh2-enum-algos lists supported KEX, cipher, and MAC algorithms, ssh-hostkey shows host keys, and ssh-auth-methods with ssh.user reveals accepted authentication methods. Combine with ssh-audit for a full crypto and CVE report.

How to test SSH for default or weak credentials?▼

Try vendor default credential lists and SecLists ssh-betterdefaultpasslist.txt, then brute force with hydra or netexec using a small targeted password list. Confirm password auth is offered first by running ssh -v and checking the authentications that can continue.

How do I confirm the XZ backdoor CVE-2024-3094 on a server?▼

Do not trust the SSH banner alone. Check the installed xz/liblzma version with xz --version and package managers, hash the liblzma shared objects, and verify with ldd whether sshd actually links against the affected library.

Can an SFTP-only user escape to a shell?▼

Yes, if password or keyboard-interactive auth spawns a command before nologin or ForceCommand restrictions apply. Test by requesting a command at connect time, such as ssh user@host /bin/bash, and check whether output returns despite the no-shell configuration.

What OpenSSH versions are vulnerable to regreSSHion CVE-2024-6387?▼

OpenSSH versions 8.5p1 through 9.7p1 are affected when LoginGraceTime is non-zero, allowing a pre-auth signal handler race condition. Identify the version from the banner and recommend upgrading rather than weaponizing the timing-based exploit in production.

Related Skills

Explore More Software Engineering Skills→
L3DigitalNetL3DigitalNet
6

nmap

Scan networks for hosts, ports, services, and operating systems using nmap.

Official
Intermediate
wgpsecwgpsec
1.6k

post-exploit-linux

Plan and execute Linux post-exploitation workflows from initial access through privilege escalation.

Official
Advanced
AeonDaveAeonDave
15

hydra

Perform online brute-force and password spraying attacks against over 50 network protocols.

Community
Intermediate
gerald-icagerald-ica

SSH Penetration Testing

Assess SSH service security through enumeration, configuration auditing, and credential attacks.

Community
Advanced