What problem does it solve? When an authorized penetration test or CTF challenge exposes port 22, testers need a structured methodology to enumerate the SSH service, attack authentication, pivot through tunnels, and check for known CVEs instead of running ad-hoc commands. ## Core Features & Use Cases - Phased Methodology: A seven-phase decision tree covering service discovery, auth-method enumeration, username enumeration (CVE-2018-15473), credential brute-forcing, SSH tunneling, key theft and reuse, and known vulnerability exploitation. - Detailed Command Reference: A companion references/ssh-techniques.md file with copy-ready commands for ssh-audit, hydra, nmap NSE scripts, Metasploit modules, ssh2john/hashcat key cracking, and SSH-Snake lateral movement. - Use Case: During an authorized assessment you find OpenSSH 9.3 on port 22. The skill routes you to check CVE-2024-6387 (regreSSHion), enumerate auth methods, and if credentials are obtained, set up dynamic SOCKS forwarding with ssh -D plus proxychains to reach internal services. ## Quick Start Ask the agent to run the SSH pentesting methodology against the authorized target at 10.10.10.5 and report the SSH version, supported authentication methods, and any applicable CVEs.
