ssh-penetration-testing
Conducts comprehensive SSH security assessments, including enumeration, credential attacks, and vulnerability exploitation.
Install this skill
Security score
The ssh-penetration-testing skill was audited on Mar 4, 2026 and we found 32 security issues across 3 threat categories, including 13 high-severity. Review the findings below before installing.
Categories Tested
Security Issues
Curl to non-GitHub URL
| 193 | curl -s http://target.com/.ssh/id_rsa |
Curl to non-GitHub URL
| 194 | curl -s http://target.com/id_rsa |
Curl to non-GitHub URL
| 195 | curl -s http://target.com/backup/ssh_keys.tar.gz |
Access to /etc/passwd
| 320 | cat /etc/passwd | grep -v nologin |
Access to hidden dotfiles in home directory
| 184 | ~/.ssh/id_rsa |
Access to hidden dotfiles in home directory
| 185 | ~/.ssh/id_dsa |
Access to hidden dotfiles in home directory
| 186 | ~/.ssh/id_ecdsa |
Access to hidden dotfiles in home directory
| 187 | ~/.ssh/id_ed25519 |
Access to hidden dotfiles in home directory
| 288 | # ~/.ssh/config |
Access to hidden dotfiles in home directory
| 309 | ls -la ~/.ssh/ |
Access to hidden dotfiles in home directory
| 310 | cat ~/.ssh/known_hosts |
Access to hidden dotfiles in home directory
| 311 | cat ~/.ssh/authorized_keys |
Access to hidden dotfiles in home directory
| 314 | echo "ssh-rsa AAAAB3..." >> ~/.ssh/authorized_keys |
Access to hidden dotfiles in home directory
| 324 | cat ~/.bash_history | grep -i ssh |
Access to hidden dotfiles in home directory
| 325 | cat ~/.bash_history | grep -i pass |
Access to root home directory
| 189 | /root/.ssh/ |
Access to SSH directory
| 184 | ~/.ssh/id_rsa |
Access to SSH directory
| 185 | ~/.ssh/id_dsa |
Access to SSH directory
| 186 | ~/.ssh/id_ecdsa |
Access to SSH directory
| 187 | ~/.ssh/id_ed25519 |
Access to SSH directory
| 189 | /root/.ssh/ |
Access to SSH directory
| 190 | /home/*/.ssh/ |
Access to SSH directory
| 193 | curl -s http://target.com/.ssh/id_rsa |
Access to SSH directory
| 288 | # ~/.ssh/config |
Access to SSH directory
| 309 | ls -la ~/.ssh/ |
Access to SSH directory
| 310 | cat ~/.ssh/known_hosts |
Access to SSH directory
| 311 | cat ~/.ssh/authorized_keys |
Access to SSH directory
| 314 | echo "ssh-rsa AAAAB3..." >> ~/.ssh/authorized_keys |
External URL reference
| 193 | curl -s http://target.com/.ssh/id_rsa |
External URL reference
| 194 | curl -s http://target.com/id_rsa |
External URL reference
| 195 | curl -s http://target.com/backup/ssh_keys.tar.gz |
External URL reference
| 236 | # Now access http://localhost:8080 |