skills.rest
gerald-ica
gerald-icaCOMMUNITY
Explore all skills by this author →
GitHub

SSH Penetration Testing

Assess SSH service security through enumeration, configuration auditing, and credential attacks.

Updated Apr 6, 2026
Search Tags:#penetration testing#SSH#security assessment#SSH tunneling#SSH auditing
One-click install
npx skills add https://github.com/gerald-ica/dev-tool-configs --skill ssh-penetration-testing-gerald-ica
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: SSH Penetration Testing
Source: https://github.com/gerald-ica/dev-tool-configs/tree/main/gemini/skills/ssh-penetration-testing
Command: npx skills add https://github.com/gerald-ica/dev-tool-configs --skill ssh-penetration-testing-gerald-ica

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires nmap, hydra, medusa, ssh-audit, metasploit, python3, paramiko, ssh, and includes scripts (resource) and references (resource) components.

What problem does it solve?

This skill unit is designed to solve the problem of inadequate SSH security by offering a comprehensive set of tools and techniques for assessing, enumerating, and testing SSH services and configurations.

Core Features & Use Cases

  • SSH Service Discovery: Identifies SSH services running on target networks, with options for scanning various ports and using different detection methods.
  • SSH Enumeration: Gathers detailed information about SSH services, including banner grabbing, version detection, and enumeration of supported algorithms and authentication methods.
  • Configuration Auditing: Conducts a thorough audit of SSH configurations to identify and mitigate potential vulnerabilities.
  • Credential Attacks: Executes brute-force attacks on SSH credentials using tools like Hydra and Medusa, including username and password lists and common password attempts.
  • Vulnerability Exploitation: Utilizes Metasploit for detecting known SSH vulnerabilities and potential exploits.
  • SSH Tunneling and Port Forwarding: Demonstrates the setup and use of SSH tunnels for network pivoting and port forwarding.
  • Post-Exploitation Activities: Provides guidance on activities following successful SSH access, such as privilege escalation, key management, and extracting configuration details.

Quick Start

Run the SSH Penetration Testing skill to begin the assessment of SSH services on your target network using ./ssh-pentest-assessment.sh

Frequently Asked Questions about SSH Penetration Testing

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I perform a comprehensive SSH security assessment on a target network?▼

Comprehensive SSH security assessment involves identifying running SSH instances using Nmap, auditing configurations with ssh-audit, and executing credential attacks. This process evaluates SSH service vulnerabilities, tests brute-force credentials using Hydra and Medusa, and establishes SSH tunnels for network pivoting.

What is the best way to audit SSH configurations and detect supported algorithms?▼

Auditing SSH configurations to detect supported algorithms involves using ssh-audit for banner grabbing and version detection. This identifies weak cryptographic algorithms and authentication methods, providing detailed enumeration of the SSH service to mitigate potential vulnerabilities.

Can I use Hydra and Medusa for brute-force attacks on SSH credentials?▼

Hydra and Medusa execute brute-force attacks on SSH credentials by leveraging username and password lists. These tools automate common password attempts against target SSH services, enabling security assessments to validate authentication robustness and identify weak credentials.

How does SSH tunneling and port forwarding work for network pivoting?▼

SSH tunneling and port forwarding work by creating encrypted network connections through the SSH protocol, enabling network pivoting. This technique allows security testers to route traffic through a compromised SSH service to access otherwise restricted internal network segments.

Do I need Python with Paramiko to exploit known SSH vulnerabilities?▼

Python with Paramiko and Metasploit are required to exploit known SSH vulnerabilities. Metasploit detects and executes potential exploits, while Paramiko provides the programmatic SSH client interface needed for custom exploitation scripts and post-exploitation activities.

What post-exploitation activities should I perform after gaining SSH access?▼

Post-exploitation activities after gaining SSH access include privilege escalation, SSH key management, and extracting configuration details. These actions assess the depth of compromise and identify further network exposure following successful SSH service exploitation.

Related Skills

zebbernzebbern
4.5k

SSH Penetration Testing

Automate SSH security assessments with enumeration, credential attacks, and vulnerability exploitation.

Community
Advanced
AndyAnh174AndyAnh174

SSH Penetration Testing

Enumerates SSH configurations and tests credentials with Nmap, Hydra, and ssh-audit.

Community
Advanced
macaughmacaugh
5

Service Fingerprinting

Detect network services and versions on discovered hosts via active probing.

Community
Advanced
Namma-FlutterNamma-Flutter
57

owasp-mobile-security-checker

Identify OWASP Mobile Top 10 (2024) vulnerabilities in Flutter apps.

Official
Advanced