ssh-penetration-testing

Enumerate and audit SSH services, configurations, and credentials for security weaknesses.

4|Updated Feb 22, 2026

Search Tags:#ssh #tunneling #security-audit #penetration-testing #credential-testing #vulnerability-assessment #ssh-configuration

Ready to run

npx skills add https://github.com/GeneralReasoning/env-skillsbench --skill ssh-penetration-testing-generalreasoning

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: ssh-penetration-testing
Source: https://github.com/GeneralReasoning/env-skillsbench/tree/main/fix-erlang-ssh-cve/environment/skills/ssh-penetration-testing
Command: npx skills add https://github.com/GeneralReasoning/env-skillsbench --skill ssh-penetration-testing-generalreasoning

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Identifies SSH service weaknesses and misconfigurations to improve host security.

Core Features & Use Cases

SSH Discovery & Enumeration: Identify SSH services, versions, supported algorithms, and host keys.
Configuration Auditing: Detect weak ciphers, MACs, KEX, and misconfigurations with actionable hardening steps.
Credential & Key Testing: Assess password policies, public key access, and key management practices; validate resilience against brute-force attempts in authorized contexts.
Tunneling & Pivoting Guidance: Document and configure local/remote/dynamic port forwarding for secure access control.
Use Case: For a secured fleet, run a controlled SSH assessment to uncover weak host configurations and credential exposure before deployment.

Quick Start

Run an authorized SSH security assessment across your target infrastructure to enumerate services, audit configurations, and test credentials, then document remediation steps.

Frequently Asked Questions about ssh-penetration-testing

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I audit SSH configurations for weak ciphers and KEX algorithms?▼

To audit SSH configurations, you scan the target host to detect weak ciphers, MACs, and KEX algorithms. This process identifies misconfigurations and provides actionable hardening steps to secure the service.

What is the best way to enumerate SSH services and supported algorithms?▼

Enumerating SSH services involves identifying active SSH versions, supported algorithms, and host keys across your network. This discovery phase maps the attack surface by revealing specific service implementations and protocol details.

How do I test SSH credential robustness and key-based access?▼

Testing SSH credential robustness assesses password policies and public key access to validate resilience against brute-force attempts. It also reviews key management practices to identify exposure risks in authorized contexts.

Can I use this SSH penetration testing workflow in enterprise network environments?▼

Yes, this SSH penetration testing workflow applies across both enterprise networks and lab environments. It supports a structured process to uncover weak host configurations and credential exposure before deployment.

How does SSH tunneling and port forwarding work during a security audit?▼

SSH tunneling during a security audit documents and configures local, remote, and dynamic port forwarding. Verifying these port-forwarding controls ensures secure access routing and prevents unauthorized pivoting.

What does an authorized SSH security assessment include?▼

An authorized SSH security assessment includes discovery, enumeration, configuration auditing, credential testing, and vulnerability checks. It also covers tunneling and post-exploitation analysis with practical command examples and tooling guidance.