Reconnaissance

The first phase of SSH penetration testing: gathering information about the target

Passive Information Gathering
Techniques to gather information without directly interacting with the target

WHOIS Lookup

WHOIS queries provide information about domain registration, including IP addresses and contact details.

Command:

whois example.com

This command retrieves registration information for the specified domain.

Command:

whois 192.168.1.1

This command retrieves information about the specified IP address.

User Enumeration
Techniques to identify potential usernames for SSH authentication attempts

Email Harvesting:

theHarvester -d example.com -b all

This command uses theHarvester tool to gather email addresses from the target domain, which can be used to derive usernames.

Username Generation:

python3 username-generator.py -f John -l Doe -o usernames.txt

This command generates potential usernames based on first and last names (e.g., jdoe, john.doe, j.doe).

Common Username Lists:

Use wordlists like those found in SecLists to attempt common usernames:

cat /usr/share/seclists/Usernames/top-usernames-shortlist.txt
Network Reconnaissance
Techniques to identify network infrastructure and potential SSH servers

Traceroute:

traceroute example.com

This command traces the route packets take to reach the target, revealing network infrastructure.

DNS Zone Transfer:

dig @ns1.example.com example.com axfr

This command attempts a zone transfer, which might reveal all DNS records for the domain.

Subdomain Enumeration:

sublist3r -d example.com

This command uses Sublist3r to enumerate subdomains, which might host SSH servers.

Documentation
Documenting your reconnaissance findings is crucial for the next phases

Information to Document:

  • IP addresses and domains identified
  • Potential usernames gathered
  • SSH servers discovered
  • Network infrastructure details
  • Potential vulnerabilities or misconfigurations

Documentation Tools:

  • Markdown files for structured notes
  • Screenshots of important findings
  • Spreadsheets for tracking multiple targets
  • Mind maps for visualizing relationships