📔
eCPPTv2 Notes
  • About
  • 1-System Security
    • Architecture Fundamentals
      • Security Implementations
      • References
    • Assembler Debuggers and Tool Arsenal
      • Compiler
      • NASM
      • Tool Arsenal
      • References
    • Buffer Overflow
      • Finding Buffer Overflows
      • Exploiting Buffer Overflow
      • Security Implementations
      • References
    • Shellcoding
      • Types of Shellcode
      • Encoding of Shellcode
      • Debugging a Shellcode
      • Creating our First Shellcode
      • More Advanced Shellcode
      • Shellcode and Payload Generators
      • References
    • Cryptography and Password Cracking
      • Cryptography Hash Function
      • Public Key Infrastructure
      • Pretty Good Privacy (PGP)
      • Secure Shell (SSH)
      • Cryptographic Attack
      • Security Pitfalls
      • Windows 2000/XP/2k3/Vista/7/8 Passwords
      • References
    • MALWARE
      • Techniques Used by Malware
      • How Malware Spreads
      • Samples
      • References
  • 2-Network Security
    • Information Gathering
      • Search Engines
      • Social Media
      • Infrastructures
      • Tools
      • References
    • Scanning
      • Detect Live Hosts and Ports
      • Service and OS detection
      • Firewall/IDS Evasion
      • References
    • Enumeration
      • NetBIOS
      • SNMP
      • References
    • Sniffing and MitM Attacks
      • What is Sniffing
      • Sniffing in Action
      • Basic of ARP
      • Sniffing Tools
      • Man in the Middle Attacks
      • Attacking Tools
      • Intercepting SSL Traffic
      • References
    • Exploitation
      • Vulnerability Assessment
      • Low Hanging Fruits
      • Exploitation
      • References
    • Post Exploitation
      • Privilege Escalation and Maintaining Access
      • Pillaging / Data Harvesting
      • Mapping the internal network
      • Exploitation through Pivoting
      • References
    • Anonymity
      • Browsing Anonymously
      • Tunneling for Anonymity
      • References
    • Social Engineering
      • Types of Social Engineering
      • Samples of Social Engineering Attacks
      • Pretexting Samples
      • Tools
      • References
  • 3-Powershell for Pentesters
    • Introduction
      • Why PowerShell ?
      • References
    • PowerShell Fundamentals
      • Cmdlets
      • Modules
      • Scripts
      • Objects
      • References
    • Offensive PowerShell
      • Downloading & Execution
      • Obfuscation
      • Information Gathering & Recon
      • Post-Exploitation With Powershell
      • References
Powered by GitBook
On this page

Was this helpful?

  1. 1-System Security
  2. Cryptography and Password Cracking

Secure Shell (SSH)

5. Secure Shell (SSH)

Secure Shell or SSH is a network protocol that allows data to be exchanged using a secure channel between two networked devices.

Very common on Unix based systems, it is used as a secure replacement for Telnet as it allows remote access to a computer through a secure shell.

A client connecting to a SSH server, will have shell access on the server, in a secure way.

SSH, by means of Public keys can enforce authentication for both client and server.

Moreover it is also used to create tunnels, ports forwarding and secure file transfer.

An SSH server, by default, listens on TCP port 22.

SSH allows one to tunnel any protocol within a secure channel. You can do so for instant messaging protocols, mount remote hard drives and so on.

To create an SSH tunnel, an SSH client is configured to forward a specified local port to a port on the remote machine.

Traffic to local port (SSH client) is forwarded to the remote host (SSH client). The remote host will then forward this traffic to the intended target host.

The traffic between SSH client and server will be encrypted.

SSH tunnels provide a means to bypass firewalls that prohibit certain internet services provided that outgoing connections are allowed.

Corporate policies and filters can be bypassed by using SSH traffic.

Scenario: Imagine being in a hotel or being connected to internet through an open insecure wireless connection.

You can establish a secure connection to your home PC with a simple command.

With this command, all the traffic sent to localhost's port 3000 will be forwarded to remote host on port 23 through the tunnel

ssh -L 3000:homepc:23 Bob@sshserver.com

Description:

  • -L is used to initiate a tunnel

  • 3000:homepc:23 is localport:remotehost:remoteport

  • bob@sshserver is username@sshserver

You can also use telnet to connect to your home PC safely:

telnet localhost:3000

It will automatically routed to your home PC through the SSH tunnel

PreviousPretty Good Privacy (PGP)NextCryptographic Attack

Last updated 4 years ago

Was this helpful?