ssh-audit — SSH Security Auditor
ssh-audit analyzes SSH server or client configurations — banner, key exchange algorithms, ciphers, MACs, compression, and known weaknesses. Use during recon when port 22 is open.
GitHub: jtesta/ssh-audit
OSCP use: Quick check after Nmap — weak algorithms, old OpenSSH versions, misconfigs. Pairs with SSH enum and Hydra if creds needed.
Install on Kali: sudo apt install ssh-audit
Syntax
ssh-audit [options] [host]📌 1) Common flags
| Flag | Description |
|---|---|
-p N | Port (default 22 for server audit) |
-v | Verbose — prefix lines with section/algorithm |
-b | Batch output — no header/empty lines (implies -v) |
-j | JSON output (-jj indented) |
-4 / -6 | Force IPv4 / IPv6 |
-46 / -64 | IPv4/IPv6 precedence when both resolve |
-T hosts.txt | Audit many hosts — one HOST[:PORT] per line |
-t N | Connection timeout (seconds) |
--threads N | Parallel threads for -T batch scans |
-l info|warn|fail | Minimum level to display |
-n | No colors |
-d | Debug output |
-L | List built-in policy names |
-P "policy" | Run policy audit (built-in name or custom .txt) |
-M file.txt | Create custom policy from target server |
-c | Client audit — listen locally (default port 2222) |
-m | Manual algorithm list (don’t fetch from server) |
--lookup alg1,alg2 | Look up algorithm security info |
--list-hardening-guides | List hardening guide platforms |
--get-hardening-guide platform | Print hardening guide for platform |
📌 2) Server audit (OSCP)
# Standard audit — single host
ssh-audit 10.10.10.10
ssh-audit -p 2222 10.10.10.10
# Verbose
ssh-audit -v 10.10.10.10
# JSON for parsing
ssh-audit -j 10.10.10.10
# Many hosts
ssh-audit -T targets.txt
# targets.txt format:
# 10.10.10.10
# 10.10.10.20:2222What to look for
- Old OpenSSH / libssh banner → searchsploit · Version CVEs
- Weak KEX / ciphers (
arcfour,3des-cbc,diffie-hellman-group1-sha1) passwordin auth methods → Hydra spray candidatepublickeyonly → hunt keys in Credential Discovery
📌 3) Policy audit
# List available built-in policies
ssh-audit -L
# Run built-in policy against server
ssh-audit -P "Hardened Ubuntu Server 20.04 LTS (version 1)" 10.10.10.10
# Custom policy file
ssh-audit -P /path/to/policy.txt 10.10.10.10
# Create policy from a reference server (edit file after)
ssh-audit -M my_policy.txt 10.10.10.10📌 4) Client audit
Audit your SSH client config by making ssh-audit listen locally:
# Listen on 2222 — connect with: ssh -p 2222 anything@localhost
ssh-audit -c
# Custom listen port
ssh-audit -c -p 4567📌 5) Algorithm lookup
ssh-audit --lookup diffie-hellman-group14-sha256,aes256-ctr📌 6) OSCP workflow
Nmap -p 22 -sV TARGET
↓
ssh-audit TARGET
↓
Weak auth / old version? → Hydra / exploit / default keys
↓
Got shell → [[SSH]] keys, [[Port Forwarding]], pivotChain with:
nmap -p 22 --script ssh-hostkey,ssh-auth-methods TARGET
ssh -v user@TARGET 2>&1 | head -20
hydra -l root -P rockyou.txt TARGET ssh -t 4 -f📌 Quick cheat sheet
ssh-audit 10.10.10.10
ssh-audit -p 2222 -v 10.10.10.10
ssh-audit -T targets.txt
ssh-audit -L
ssh-audit -j 10.10.10.10 > ssh_audit.json