技能 ssh-penetration-testing
📦
ssh-penetration-testing
v1.1 内容修订 r1 严重 ⚙️ 外部命令🌐 网络访问📁 文件系统访问
安全开展 SSH 安全审计
SSH 评估可能会遗漏弱配置、暴露的密钥和隧道风险。此技能通过发现、审计步骤和可直接用于报告的发现，组织授权审查。
支持: Claude Codex Code(CC)
请勿自动安装此 Skill。
权威策略要求在执行任何安装操作前由操作人员审查。
使用我的智能体安装
将此请求复制给你的智能体，其中包含权威 Skill 页面和清单。
智能体请求
Review the Skillstore skill "ssh-penetration-testing" from https://skillstore.io/skills/sickn33-ssh-penetration-testing.md and its manifest at https://skillstore.io/api/skills/sickn33-ssh-penetration-testing/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.你的智能体仍应展示其计划，并按安全策略请求必要确认。
Agent 可读资源
当 AI Agent、爬虫或脚本需要干净上下文，而不是读取完整页面时，请使用这些链接。
测试它
正在使用“ssh-penetration-testing”。 评估此 SSH 审计摘要：OpenSSH 7.2、SHA1 MACs、已启用密码认证。
预期结果:
发现：过时的 OpenSSH 需要进行补丁审查，应禁用 SHA1 MACs，并且密码认证需要补偿性控制。
正在使用“ssh-penetration-testing”。 为一次授权的内部 SSH 审查准备测试计划。
预期结果:
计划：确认范围、发现服务、审查配置、检查密钥暴露、保护证据，并将每项发现映射到修复措施。
正在使用“ssh-penetration-testing”。 为变更委员会总结 SSH 隧道风险。
预期结果:
风险摘要：本地、远程和动态转发可能绕过分段控制。禁用未使用的转发，并监控已批准的例外。
安全审计
严重v5 • 2026/7/9 打开版本化报告
The skill is highly dual-use and includes credential attacks, SSH key discovery, Metasploit usage, tunneling, pivoting, and post-exploitation actions. Markdown backtick detections and placeholder private IP findings were dismissed where they were only formatting or example targets. Confirmed findings show unacceptable risk for unsupervised marketplace publishing without major safety restructuring.
1
已扫描文件
489
分析行数
42
复核项
0
已忽略误报
已确认安全问题 (55)
严重
SSH directory access
~/.ssh/id_rsa
The skill identifies or reads SSH directories and key files during exposed-key checks or post-exploitation. These locations can contain secrets and trust material.
严重
SSH directory access
~/.ssh/id_dsa
The skill identifies or reads SSH directories and key files during exposed-key checks or post-exploitation. These locations can contain secrets and trust material.
严重
SSH directory access
~/.ssh/id_ecdsa
The skill identifies or reads SSH directories and key files during exposed-key checks or post-exploitation. These locations can contain secrets and trust material.
严重
SSH directory access
~/.ssh/id_ed25519
The skill identifies or reads SSH directories and key files during exposed-key checks or post-exploitation. These locations can contain secrets and trust material.
严重
SSH directory access
/root/.ssh/
The skill identifies or reads SSH directories and key files during exposed-key checks or post-exploitation. These locations can contain secrets and trust material.
严重
SSH directory access
/home/*/.ssh/
The skill identifies or reads SSH directories and key files during exposed-key checks or post-exploitation. These locations can contain secrets and trust material.
严重
SSH directory access
curl -s http://target.com/.ssh/id_rsa
The skill identifies or reads SSH directories and key files during exposed-key checks or post-exploitation. These locations can contain secrets and trust material.
严重
SSH directory access
ls -la ~/.ssh/
The skill identifies or reads SSH directories and key files during exposed-key checks or post-exploitation. These locations can contain secrets and trust material.
显示全部 55 条已确认问题
严重
SSH directory access
cat ~/.ssh/known_hosts
The skill identifies or reads SSH directories and key files during exposed-key checks or post-exploitation. These locations can contain secrets and trust material.
严重
SSH directory access
cat ~/.ssh/authorized_keys
The skill identifies or reads SSH directories and key files during exposed-key checks or post-exploitation. These locations can contain secrets and trust material.
严重
SSH directory access
echo "ssh-rsa AAAAB3..." >> ~/.ssh/authorized_keys
The skill identifies or reads SSH directories and key files during exposed-key checks or post-exploitation. These locations can contain secrets and trust material.
严重
SSH private key file
ssh -i id_rsa user@192.168.1.100
The reference is to private key files used for login attempts, key discovery, web retrieval, filesystem search, or Metasploit key authentication. Private keys are sensitive credentials.
严重
SSH private key file
ssh -o IdentitiesOnly=yes -i id_rsa user@192.168.1.100
The reference is to private key files used for login attempts, key discovery, web retrieval, filesystem search, or Metasploit key authentication. Private keys are sensitive credentials.
严重
SSH private key file
for key in id_rsa id_dsa id_ecdsa id_ed25519; do
The reference is to private key files used for login attempts, key discovery, web retrieval, filesystem search, or Metasploit key authentication. Private keys are sensitive credentials.
严重
SSH private key file
~/.ssh/id_rsa
The reference is to private key files used for login attempts, key discovery, web retrieval, filesystem search, or Metasploit key authentication. Private keys are sensitive credentials.
严重
SSH private key file
~/.ssh/id_dsa
The reference is to private key files used for login attempts, key discovery, web retrieval, filesystem search, or Metasploit key authentication. Private keys are sensitive credentials.
严重
SSH private key file
~/.ssh/id_ecdsa
The reference is to private key files used for login attempts, key discovery, web retrieval, filesystem search, or Metasploit key authentication. Private keys are sensitive credentials.
严重
SSH private key file
~/.ssh/id_ed25519
The reference is to private key files used for login attempts, key discovery, web retrieval, filesystem search, or Metasploit key authentication. Private keys are sensitive credentials.
严重
SSH private key file
curl -s http://target.com/.ssh/id_rsa
The reference is to private key files used for login attempts, key discovery, web retrieval, filesystem search, or Metasploit key authentication. Private keys are sensitive credentials.
严重
SSH private key file
curl -s http://target.com/id_rsa
The reference is to private key files used for login attempts, key discovery, web retrieval, filesystem search, or Metasploit key authentication. Private keys are sensitive credentials.
严重
SSH private key file
find / -name "id_rsa" 2>/dev/null
The reference is to private key files used for login attempts, key discovery, web retrieval, filesystem search, or Metasploit key authentication. Private keys are sensitive credentials.
严重
SSH private key file
find / -name "id_dsa" 2>/dev/null
The reference is to private key files used for login attempts, key discovery, web retrieval, filesystem search, or Metasploit key authentication. Private keys are sensitive credentials.
严重
SSH private key file
set KEY_FILE /path/to/id_rsa
The reference is to private key files used for login attempts, key discovery, web retrieval, filesystem search, or Metasploit key authentication. Private keys are sensitive credentials.
严重
SSH host/auth files
echo "ssh-rsa AAAAB3..." >> ~/.ssh/authorized_keys
The command appends a key to authorized_keys under an add-persistence heading. That creates unauthorized persistent access if misused.
严重
Crypto seed/private key mention
# Attempt login with found private key
The private key mention appears in found-key login or key-location guidance. That supports use or discovery of sensitive credential material.
严重
Crypto seed/private key mention
# Common locations for private keys
The private key mention appears in found-key login or key-location guidance. That supports use or discovery of sensitive credential material.
严重
Metasploit framework
- Metasploit Framework
The skill requires and demonstrates Metasploit SSH scanner, login, public-key login, and enumeration modules. These are offensive exploitation-framework workflows.
严重
Metasploit framework
# Metasploit enumeration
The skill requires and demonstrates Metasploit SSH scanner, login, public-key login, and enumeration modules. These are offensive exploitation-framework workflows.
严重
Metasploit framework
### Phase 10: Metasploit SSH Modules
The skill requires and demonstrates Metasploit SSH scanner, login, public-key login, and enumeration modules. These are offensive exploitation-framework workflows.
严重
Metasploit framework
Use Metasploit for comprehensive SSH testing:
The skill requires and demonstrates Metasploit SSH scanner, login, public-key login, and enumeration modules. These are offensive exploitation-framework workflows.
严重
Metasploit framework
# Start Metasploit
The skill requires and demonstrates Metasploit SSH scanner, login, public-key login, and enumeration modules. These are offensive exploitation-framework workflows.
严重
Metasploit framework
| Metasploit | `use auxiliary/scanner/ssh/ssh_login` |
The skill requires and demonstrates Metasploit SSH scanner, login, public-key login, and enumeration modules. These are offensive exploitation-framework workflows.
严重
System password file access
cat /etc/passwd | grep -v nologin
The command reads /etc/passwd during post-exploitation to enumerate usable local accounts. That supports follow-on access and lateral movement planning.
严重
[HEURISTIC] DANGEROUS COMBINATION: Code execution + Network + Credential access
This combination is common in credential stealers and RATs
The content combines credential brute forcing, private key access, tunneling, Metasploit modules, and remote command execution. That combination strongly matches offensive compromise workflows.
严重
[HEURISTIC] SUSPICIOUS COMBINATION: Filesystem + Credentials + Network
This combination could indicate credential harvesting and exfiltration
The skill links network access with filesystem searches for SSH keys, authorized_keys, and shell history. That creates a clear credential harvesting and pivoting risk.
严重
Credential Attack and Evasion Guidance
The skill provides SSH brute-force, password spraying, rate-limit evasion, and distributed attack advice that can enable unauthorized credential attacks.
The cited sections explicitly describe brute-force, password spraying, slow brute-force, and distributing attacks across IPs.
严重
SSH Persistence Instructions
The post-exploitation section tells users to add their key to authorized_keys for persistence, creating ongoing access after compromise.
The heading states add persistence, and the command appends an SSH public key to authorized_keys.
严重
Post-Compromise Credential Harvesting
The workflow searches for private keys, reads SSH trust files, and searches shell history for passwords after gaining SSH access.
The post-exploitation section directly includes key searches, authorized_keys access, and shell history searches for password strings.
高
SSH host/auth files
find / -name "authorized_keys" 2>/dev/null
The command locates or reads SSH authorization and host trust files during post-exploitation. These files can reveal access paths and trusted hosts.
高
SSH host/auth files
cat ~/.ssh/known_hosts
The command locates or reads SSH authorization and host trust files during post-exploitation. These files can reveal access paths and trusted hosts.
高
SSH host/auth files
cat ~/.ssh/authorized_keys
The command locates or reads SSH authorization and host trust files during post-exploitation. These files can reveal access paths and trusted hosts.
高
System reconnaissance
output, _ = execute_command(client, 'id; uname -a')
The Paramiko example runs id and uname after a successful brute-force login. That is remote post-compromise reconnaissance through an SSH session.
高
Network scanning tools
- Nmap with SSH scripts
The skill requires or demonstrates Nmap SSH scanning, NSE scripts, and proxied scanning. These are active network reconnaissance steps with misuse potential.
高
Network scanning tools
nmap -p 22 192.168.1.0/24 --open
The skill requires or demonstrates Nmap SSH scanning, NSE scripts, and proxied scanning. These are active network reconnaissance steps with misuse potential.
高
Network scanning tools
nmap -p 22,2222,22222,2200 192.168.1.100
The skill requires or demonstrates Nmap SSH scanning, NSE scripts, and proxied scanning. These are active network reconnaissance steps with misuse potential.
高
Network scanning tools
nmap -p- --open 192.168.1.100 | grep -i ssh
The skill requires or demonstrates Nmap SSH scanning, NSE scripts, and proxied scanning. These are active network reconnaissance steps with misuse potential.
高
Network scanning tools
nmap -sV -p 22 192.168.1.100
The skill requires or demonstrates Nmap SSH scanning, NSE scripts, and proxied scanning. These are active network reconnaissance steps with misuse potential.
高
Network scanning tools
# Nmap version detection with scripts
The skill requires or demonstrates Nmap SSH scanning, NSE scripts, and proxied scanning. These are active network reconnaissance steps with misuse potential.
高
Network scanning tools
nmap -sV -p 22 --script ssh-hostkey 192.168.1.100
The skill requires or demonstrates Nmap SSH scanning, NSE scripts, and proxied scanning. These are active network reconnaissance steps with misuse potential.
高
Network scanning tools
nmap -p 22 --script ssh2-enum-algos 192.168.1.100
The skill requires or demonstrates Nmap SSH scanning, NSE scripts, and proxied scanning. These are active network reconnaissance steps with misuse potential.
高
Network scanning tools
nmap -p 22 --script ssh-hostkey --script-args ssh_hostkey=full 192.168.1.100
The skill requires or demonstrates Nmap SSH scanning, NSE scripts, and proxied scanning. These are active network reconnaissance steps with misuse potential.
高
Network scanning tools
nmap -p 22 --script ssh-auth-methods --script-args="ssh.user=root" 192.168.1.100
The skill requires or demonstrates Nmap SSH scanning, NSE scripts, and proxied scanning. These are active network reconnaissance steps with misuse potential.
高
Network scanning tools
proxychains nmap -sT -Pn 192.168.1.0/24
The skill requires or demonstrates Nmap SSH scanning, NSE scripts, and proxied scanning. These are active network reconnaissance steps with misuse potential.
高
Network scanning tools
| `nmap --script ssh*` | SSH NSE scripts |
The skill requires or demonstrates Nmap SSH scanning, NSE scripts, and proxied scanning. These are active network reconnaissance steps with misuse potential.
高
Pivoting and Reverse Tunnel Guidance
The tunneling section includes reverse shell callback forwarding, SOCKS proxy setup, and proxychains scanning for internal network pivoting.
The cited lines explicitly mention a reverse shell callback, SOCKS proxy creation, and proxied Nmap scanning.
能力复核项 (42)
这些是真实的本地能力，对此技能可能是预期行为，因此需要复核，但不会按已确认恶意行为计分。
严重
Hidden file in home directory
~/.ssh/id_rsa
The line references SSH private key or authorization files in a key discovery or post-exploitation context. These hidden files commonly contain credential material.
严重
Hidden file in home directory
~/.ssh/id_dsa
The line references SSH private key or authorization files in a key discovery or post-exploitation context. These hidden files commonly contain credential material.
严重
Hidden file in home directory
~/.ssh/id_ecdsa
The line references SSH private key or authorization files in a key discovery or post-exploitation context. These hidden files commonly contain credential material.
严重
Hidden file in home directory
~/.ssh/id_ed25519
The line references SSH private key or authorization files in a key discovery or post-exploitation context. These hidden files commonly contain credential material.
严重
Hidden file in home directory
ls -la ~/.ssh/
The line references SSH private key or authorization files in a key discovery or post-exploitation context. These hidden files commonly contain credential material.
严重
Hidden file in home directory
cat ~/.ssh/known_hosts
The line references SSH private key or authorization files in a key discovery or post-exploitation context. These hidden files commonly contain credential material.
严重
Hidden file in home directory
cat ~/.ssh/authorized_keys
The line references SSH private key or authorization files in a key discovery or post-exploitation context. These hidden files commonly contain credential material.
严重
Hidden file in home directory
echo "ssh-rsa AAAAB3..." >> ~/.ssh/authorized_keys
The line references SSH private key or authorization files in a key discovery or post-exploitation context. These hidden files commonly contain credential material.
严重
Hidden file access
~/.ssh/id_rsa
The access targets SSH private key paths, SSH directories, or authorized key files. In this context it supports credential harvesting or persistence.
严重
Hidden file access
~/.ssh/id_dsa
The access targets SSH private key paths, SSH directories, or authorized key files. In this context it supports credential harvesting or persistence.
严重
Hidden file access
~/.ssh/id_ecdsa
The access targets SSH private key paths, SSH directories, or authorized key files. In this context it supports credential harvesting or persistence.
严重
Hidden file access
~/.ssh/id_ed25519
The access targets SSH private key paths, SSH directories, or authorized key files. In this context it supports credential harvesting or persistence.
严重
Hidden file access
/root/.ssh/
The access targets SSH private key paths, SSH directories, or authorized key files. In this context it supports credential harvesting or persistence.
严重
Hidden file access
/home/*/.ssh/
The access targets SSH private key paths, SSH directories, or authorized key files. In this context it supports credential harvesting or persistence.
严重
Hidden file access
curl -s http://target.com/.ssh/id_rsa
The access targets SSH private key paths, SSH directories, or authorized key files. In this context it supports credential harvesting or persistence.
严重
Hidden file access
ls -la ~/.ssh/
The access targets SSH private key paths, SSH directories, or authorized key files. In this context it supports credential harvesting or persistence.
严重
Hidden file access
cat ~/.ssh/known_hosts
The access targets SSH private key paths, SSH directories, or authorized key files. In this context it supports credential harvesting or persistence.
严重
Hidden file access
cat ~/.ssh/authorized_keys
The access targets SSH private key paths, SSH directories, or authorized key files. In this context it supports credential harvesting or persistence.
严重
Hidden file access
echo "ssh-rsa AAAAB3..." >> ~/.ssh/authorized_keys
The access targets SSH private key paths, SSH directories, or authorized key files. In this context it supports credential harvesting or persistence.
高
sudo privilege escalation
# Check sudo privileges
This appears in the post-exploitation workflow and directs checking sudo privileges after SSH access. That supports privilege escalation assessment on a compromised host.
高
sudo privilege escalation
sudo -l
This appears in the post-exploitation workflow and directs checking sudo privileges after SSH access. That supports privilege escalation assessment on a compromised host.
高
Hardcoded URL
curl -s http://target.com/.ssh/id_rsa
The URL is a placeholder, but it is used to retrieve SSH private key material or key archives from a web target. That is credential exposure guidance, not a benign link.
高
Hardcoded URL
curl -s http://target.com/id_rsa
The URL is a placeholder, but it is used to retrieve SSH private key material or key archives from a web target. That is credential exposure guidance, not a benign link.
高
Hardcoded URL
curl -s http://target.com/backup/ssh_keys.tar.gz
The URL is a placeholder, but it is used to retrieve SSH private key material or key archives from a web target. That is credential exposure guidance, not a benign link.
高
SSH protocol URL
hydra -l admin -P /usr/share/wordlists/rockyou.txt ssh://192.168.1.100
The SSH URL appears in Hydra credential attack examples, including password spraying and exit-on-success behavior. This is actionable brute-force guidance.
高
SSH protocol URL
hydra -L users.txt -p Password123 ssh://192.168.1.100
The SSH URL appears in Hydra credential attack examples, including password spraying and exit-on-success behavior. This is actionable brute-force guidance.
高
SSH protocol URL
hydra -L users.txt -P passwords.txt ssh://192.168.1.100
The SSH URL appears in Hydra credential attack examples, including password spraying and exit-on-success behavior. This is actionable brute-force guidance.
高
SSH protocol URL
hydra -l admin -P passwords.txt -s 2222 ssh://192.168.1.100
The SSH URL appears in Hydra credential attack examples, including password spraying and exit-on-success behavior. This is actionable brute-force guidance.
高
SSH protocol URL
hydra -l admin -P passwords.txt -t 1 -w 5 ssh://192.168.1.100
The SSH URL appears in Hydra credential attack examples, including password spraying and exit-on-success behavior. This is actionable brute-force guidance.
高
SSH protocol URL
hydra -l admin -P passwords.txt -vV ssh://192.168.1.100
The SSH URL appears in Hydra credential attack examples, including password spraying and exit-on-success behavior. This is actionable brute-force guidance.
高
SSH protocol URL
hydra -l admin -P passwords.txt -f ssh://192.168.1.100
The SSH URL appears in Hydra credential attack examples, including password spraying and exit-on-success behavior. This is actionable brute-force guidance.
高
SSH protocol URL
hydra -L users.txt -p Summer2024! ssh://192.168.1.100
The SSH URL appears in Hydra credential attack examples, including password spraying and exit-on-success behavior. This is actionable brute-force guidance.
高
SSH protocol URL
hydra -L users.txt -p "$pass" ssh://192.168.1.100
The SSH URL appears in Hydra credential attack examples, including password spraying and exit-on-success behavior. This is actionable brute-force guidance.
高
SSH protocol URL
| Hydra | `hydra -l user -P pass.txt ssh://host` |
The SSH URL appears in Hydra credential attack examples, including password spraying and exit-on-success behavior. This is actionable brute-force guidance.
高
SOCKS proxy
echo "socks5 127.0.0.1 1080" >> /etc/proxychains.conf
The proxychains SOCKS configuration is part of a pivoting workflow and is followed by proxied network scanning. This can bypass network segmentation during misuse.
高
Hidden file in home directory
cat ~/.bash_history | grep -i ssh
The workflow searches hidden shell history for SSH and password material after access. That is credential discovery from user files.
高
Hidden file in home directory
cat ~/.bash_history | grep -i pass
The workflow searches hidden shell history for SSH and password material after access. That is credential discovery from user files.
高
Hidden file access
cat ~/.bash_history | grep -i ssh
The command searches hidden shell history for SSH and password strings during post-exploitation. That is credential discovery behavior.
高
Hidden file access
cat ~/.bash_history | grep -i pass
The command searches hidden shell history for SSH and password strings during post-exploitation. That is credential discovery behavior.
高
Standard device file access
find / -name "id_rsa" 2>/dev/null
The find command searches the whole filesystem for SSH private keys or authorization files after gaining access. That is credential discovery, even though the path pattern is generic.
高
Standard device file access
find / -name "id_dsa" 2>/dev/null
The find command searches the whole filesystem for SSH private keys or authorization files after gaining access. That is credential discovery, even though the path pattern is generic.
高
Standard device file access
find / -name "authorized_keys" 2>/dev/null
The find command searches the whole filesystem for SSH private keys or authorization files after gaining access. That is credential discovery, even though the path pattern is generic.
风险因素
⚙️ 外部命令 (46)
SKILL.md:43-55 SKILL.md:55-61 SKILL.md:61-80 SKILL.md:80-86 SKILL.md:86-97 SKILL.md:97-109 SKILL.md:109-130 SKILL.md:130-134 SKILL.md:134-146 SKILL.md:146-150 SKILL.md:150-158 SKILL.md:158-164 SKILL.md:164-178 SKILL.md:178-182 SKILL.md:182-196 SKILL.md:196-202 SKILL.md:202-223 SKILL.md:223-231 SKILL.md:231-243 SKILL.md:243-249 SKILL.md:249-258 SKILL.md:258-264 SKILL.md:264-274 SKILL.md:274-280 SKILL.md:280-293 SKILL.md:293-299 SKILL.md:299-326 SKILL.md:326-332 SKILL.md:332-386 SKILL.md:386-392 SKILL.md:392-424 SKILL.md:424-432 SKILL.md:432-433 SKILL.md:433-434 SKILL.md:434-435 SKILL.md:435-441 SKILL.md:441-442 SKILL.md:442-443 SKILL.md:443-444 SKILL.md:444-450 SKILL.md:450-451 SKILL.md:451-452 SKILL.md:452-477 SKILL.md:477-488 SKILL.md:300 SKILL.md:301
🌐 网络访问 (50)
SKILL.md:193 SKILL.md:194 SKILL.md:195 SKILL.md:236 SKILL.md:45 SKILL.md:48 SKILL.md:51 SKILL.md:54 SKILL.md:63 SKILL.md:67 SKILL.md:70 SKILL.md:73 SKILL.md:76 SKILL.md:79 SKILL.md:88 SKILL.md:91 SKILL.md:111 SKILL.md:114 SKILL.md:117 SKILL.md:120 SKILL.md:123 SKILL.md:126 SKILL.md:129 SKILL.md:136 SKILL.md:142 SKILL.md:145 SKILL.md:152 SKILL.md:156 SKILL.md:166 SKILL.md:169 SKILL.md:172 SKILL.md:176 SKILL.md:215 SKILL.md:220 SKILL.md:235 SKILL.md:239 SKILL.md:242 SKILL.md:253 SKILL.md:257 SKILL.md:266 SKILL.md:269 SKILL.md:270 SKILL.md:290 SKILL.md:292 SKILL.md:377 SKILL.md:398 SKILL.md:403 SKILL.md:411 SKILL.md:418 SKILL.md:111
📁 文件系统访问 (28)
SKILL.md:184 SKILL.md:185 SKILL.md:186 SKILL.md:187 SKILL.md:288 SKILL.md:309 SKILL.md:310 SKILL.md:311 SKILL.md:314 SKILL.md:324 SKILL.md:325 SKILL.md:184 SKILL.md:185 SKILL.md:186 SKILL.md:187 SKILL.md:189 SKILL.md:190 SKILL.md:193 SKILL.md:288 SKILL.md:309 SKILL.md:310 SKILL.md:311 SKILL.md:314 SKILL.md:324 SKILL.md:325 SKILL.md:304 SKILL.md:305 SKILL.md:306
检测到的模式
SSH directory access×11SSH private key file×12Metasploit framework×6System password file accessSystem reconnaissanceNetwork scanning tools×12[HEURISTIC] DANGEROUS COMBINATION: Code execution + Network + Credential access
审计者: codex 查看审计历史 →
分享与引用此报告
分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据，不判断该 Skill 是否安全。
复制报告链接
https://skillstore.io/skills/sickn33-ssh-penetration-testing/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown 徽章
[](https://skillstore.io/skills/sickn33-ssh-penetration-testing?utm_source=security_passport_badge)HTML 徽章
<a href="https://skillstore.io/skills/sickn33-ssh-penetration-testing?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-ssh-penetration-testing/security.svg" alt="Skillstore security assessment" loading="lazy"></a>嵌入卡片
<iframe src="https://skillstore.io/embed/skills/sickn33-ssh-penetration-testing.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>学术引用 (APA · BibTeX · CFF)
APA 引用
sickn33. (2026). ssh-penetration-testing security audit report (audit version 5) [Author version 1.1]. Skillstore. https://skillstore.io/skills/sickn33-ssh-penetration-testing/audits/5BibTeX 引用
@techreport{sickn33-sickn33-ssh-penetration-testing-2026,
author = {sickn33},
title = {ssh-penetration-testing security audit report (audit version 5)},
institution = {Skillstore},
year = {2026},
number = {5},
url = {https://skillstore.io/skills/sickn33-ssh-penetration-testing/audits/5},
note = {Author version 1.1}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "ssh-penetration-testing security audit report (audit version 5)"
version: "1.1"
type: report
authors:
- name: "sickn33"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/sickn33-ssh-penetration-testing/audits/5"
identifiers:
- type: other
value: "skillstore:sickn33-ssh-penetration-testing:audit:5"
description: "Skillstore immutable audit report identifier"
Skillstore 评分
评分依据 证据置信度: 中 55
架构
85
可维护性
87
内容
70
社区
83
规范符合性
你能构建什么
准备 SSH 评估计划
为授权的 SSH 发现、配置审查和证据收集创建有范围限定的工作流。
审查基础设施加固
识别自有系统中的 OpenSSH 配置弱点、密钥暴露风险和隧道控制。
将发现转化为修复措施
将 SSH 测试观察结果转化为清晰的报告章节、优先级和面向负责人的行动项。
试试这些提示
创建 SSH 审计清单
为 [environment] 的授权评估创建有范围限定的 SSH 安全清单。包括发现、配置审查、密钥暴露检查和报告。
审查 SSH 配置风险
给定这些 ssh-audit 结果：[paste results]。总结弱算法、认证风险和加固措施。
规划凭据暴露测试
为 [scope] 规划一次获得许可的 SSH 凭据暴露测试。包括速率限制、锁定防护、证据处理和停止条件。
构建 SSH 评估报告
将这些 SSH 发现转换为执行摘要、技术发现、严重性依据和修复计划：[findings]。
最佳实践
- 在使用任何评估工作流之前，确认书面授权、范围、时间安排和停止条件。
- 使用隔离的实验室目标进行学习；仅在获得批准后进行类生产测试。
- 记录证据时不要存储私钥、密码或敏感主机数据。
避免
- 对已批准范围之外的系统运行暴力破解或扫描步骤。
- 复制、存储或重复使用评估期间发现的私钥。
- 未经明确批准，在生产系统上使用隧道或持久化示例。
常见问题
此技能对初学者安全吗？
这是双用途安全内容。初学者应使用实验室系统，并在进行实时评估前获得指导。
它可以为我运行工具吗？
不能。它提供方法论和示例。任何外部工具均由用户控制。
它需要授权吗？
是的。SSH 测试必须仅限于已有书面许可的系统。
它能帮助进行防御性加固吗？
是的。它可以组织 SSH 配置审查、弱算法识别和修复规划。
它包括凭据测试吗？
是的。它讨论凭据评估方法，这需要严格的范围控制和锁定防护。
Claude、Codex 或 Claude Code 可以使用它吗？
元数据列出 Claude、Codex 和 Claude Code 为受支持的工具。