Merge pull request #18 from clem9669/patch-5

Adding ssh-audit.py

pentesting/pentesting-ssh.md

@@ -1,6 +1,6 @@
 # 22 - Pentesting SSH/SFTP
 
-## B**asic Information**
+## Basic Information
 
 **SSH or Secure Shell or Secure Socket Shell,** is a network protocol that gives users a **secure way to access a computer over an unsecured network.**
 
@@ -10,14 +10,58 @@
 22/tcp open  ssh     syn-ack
 ```
 
-## **Enumeration**
+## Enumeration
 
-### **Banner Grabbing**
+### Banner Grabbing
 
 ```bash
 nc -vn <IP> 22
 ```
 
+### Automated ssh-audit
+
+ssh-audit is a tool for ssh server & client configuration auditing.
+
+https://github.com/jtesta/ssh-audit is an updated fork from https://github.com/arthepsy/ssh-audit/
+
+
+##### Features:
+
+- SSH1 and SSH2 protocol server support;
+- analyze SSH client configuration;
+- grab banner, recognize device or software and operating system, detect compression;
+- gather key-exchange, host-key, encryption and message authentication code algorithms;
+- output algorithm information (available since, removed/disabled, unsafe/weak/legacy, etc);
+- output algorithm recommendations (append or remove based on recognized software version);
+- output security information (related issues, assigned CVE list, etc);
+- analyze SSH version compatibility based on algorithm information;
+- historical information from OpenSSH, Dropbear SSH and libssh;
+- runs on Linux and Windows;
+- no dependencies
+
+```bash
+usage: ssh-audit.py [-1246pbcnjvlt] <host>
+
+   -1,  --ssh1             force ssh version 1 only
+   -2,  --ssh2             force ssh version 2 only
+   -4,  --ipv4             enable IPv4 (order of precedence)
+   -6,  --ipv6             enable IPv6 (order of precedence)
+   -p,  --port=<port>      port to connect
+   -b,  --batch            batch output
+   -c,  --client-audit     starts a server on port 2222 to audit client
+                               software config (use -p to change port;
+                               use -t to change timeout)
+   -n,  --no-colors        disable colors
+   -j,  --json             JSON output
+   -v,  --verbose          verbose output
+   -l,  --level=<level>    minimum output level (info|warn|fail)
+   -t,  --timeout=<secs>   timeout (in seconds) for connection and reading
+                               (default: 5)
+$ python3 ssh-audit <IP>
+```
+
+[See it in action (Asciinema)](https://asciinema.org/a/96ejZKxpbuupTK9j7h8BdClzp)
+
 ### Public SSH key of server
 
 ```bash