Password Cracking: SSH

“SSH brute-force attacks remain one of the most prevalent initial access vectors. Unlike legacy protocols, SSH’s encrypted channel presents unique challenges and opportunities for credential-based attacks.”

Encryption is why you cannot sniff an SSH password off the wire, and it is also why brute-forcing SSH is slow — every attempt costs a full key exchange, on both ends. That expense is the protocol’s only accidental defence, and OpenSSH’s MaxStartups throttle is the deliberate one. Neither stops the attack. They just decide how long it takes. Password Cracking: SSH is the operational reference for running it anyway.

Navigating the Cryptographic Barrier

The assumption worth dismantling is that an encrypted service is a protected one. Encryption secures the channel; it says nothing about who is allowed through it, and port 22 is simply an authentication gateway with a good transport underneath.

Mapped to MITRE ATT&CK as T1110.001 (Brute Force: Password Guessing), the method starts with nmap -p 22 -sV to fingerprint the OpenSSH version — which matters more than version-checking usually does here, because the daemon’s MaxAuthTries and MaxStartups settings determine how many attempts you get per connection and how many connections you get at once, and pushing past them just gets you dropped.

Multi-Framework Execution

Execution is the manual’s focus, and the constraint shaping all of it is cost per attempt. The handshake burden falls on both sides, so a thread count that saturates your own CPU frequently produces fewer successful attempts per minute than a lower one, while making the target unusable for real administrators.

Syntax across the platforms:

• Hydra and Medusa: Thread tuning to raise attempts per second without knocking the daemon over. MaxStartups will start dropping your connections probabilistically well before you notice — attempts vanish rather than fail, so a scan that looks like it is running fine can be discarding most of its work.
• NetExec (nxc): Spraying one plausible password across a whole /24 at once. Far more productive than deep brute-forcing a single host, and dramatically less likely to trip a per-host threshold.
• Ncrack and Metasploit: Modular timeout handling and adaptive throttling against daemons that fight back.
• BruteSpray: Autonomous pipelines fed straight from Nmap XML output.

Public-facing SSH has one property that makes all of this deniable: port 22 on the internet receives continuous automated credential attempts from botnets, all day, every day. An operator whose traffic resembles that background noise is genuinely difficult to distinguish from it. An operator running Hydra at forty threads is not.

Defensive Thresholds

The defensive half is threshold monitoring, since there is nothing to sniff and nothing to intercept. Fail2Ban and SSHGuard watch auth.log and ban source addresses that fail too often.

The cost is real and gets underplayed. An aggressive ban policy is a self-inflicted denial of service waiting for its moment — an office behind a single NAT egress, one user with a stale key in an automation script, and the whole site is locked out of production. Configure the ignore list before you configure the ban time. And a slow spray, one attempt per host per hour from rotating sources, sits under every threshold you are likely to set, which is why rate limiting is a mitigation and key-based authentication is the actual fix.

Who Is This Book REALLY For?

• Penetration testers: A working reference for the moment a DMZ full of Linux hosts appears and you need to test credential reuse across all of it without taking anything down.
• Linux system administrators: The argument for PasswordAuthentication no and Ed25519 keys, made by showing how little effort the alternative requires from an attacker. The trade-off is key lifecycle management — issuance, rotation and revocation across a fleet — and organisations that skip that end up with authorized_keys files containing the keys of people who left in 2021.
• Blue teams: How brute-forcing engines behave at the connection level, which is what lets you set a NIDS threshold that catches an operator without alerting on the internet’s ambient noise.

The Bottom Line

Password Cracking: SSH makes a narrow point precisely: encryption protects the conversation, not the door. A perfectly negotiated ChaCha20-Poly1305 channel carrying the password Summer2025! is a perfectly secured compromise.