Skip to content
OPS // KITitspentest.sh

E-SSH

ssh

Reach a remote shell and forward ports over an encrypted OpenSSH session.

Official siteBack to catalog

OVERVIEW

OpenSSH (openssh.com) is the standard SSH client and server. `ssh user@host` opens a remote shell; `-L` / `-D` / `-R` forward ports so a tool on your box can reach an internal service through a jump host you already control. `-J` chains jump hosts. Config lives in `~/.ssh/config` on the operator side and in `sshd_config` on the server.

Prefer keys over passwords, disable agent forwarding unless you have a reason, and pin host keys (`StrictHostKeyChecking`) so a surprise prompt is treated as a finding, not dismissed. Tunnels should be torn down when the check is done — a leftover `-L` keeps an internal port exposed on your listener.

USE CASES

Practical use cases

  • 01

    Logging into a scoped Linux or network device with provided credentials or a key.

  • 02

    Forwarding a local port to an internal HTTP or database service through a jump host.

  • 03

    Copying a small loot file with scp/sftp over the same session.

  • 04

    Checking sshd configuration and authorized_keys on a host you already have a shell on.

QUICK START

When you have in-scope credentials or a key for a host that speaks SSH, and you need a shell or a local port forward through that host.

  1. Confirm the host, account, and any tunnel destination are in scope.
  2. Connect with BatchMode first to see whether a key is already accepted.
  3. Add a local forward only for the internal port you intend to test, bound to 127.0.0.1.
  4. Close the session and the forward when the check is done; do not leave agent forwarding on.
ssh -o BatchMode=yes -o ConnectTimeout=5 [email protected]

BEFORE YOU RUN IT

What to check before running it

ForwardAgent sends your keys to the remote host; a compromised jump box can then use them. Keep it off unless the engagement requires it.

A changed host key is a warning — do not blindly accept it; it may be a misprovisioned box or an on-path device.

Remote forwards (-R) expose a port on the server side; bind them carefully and only when that exposure is authorized.

KEEP EXPLORING

View the whole phase →