alph4sec/ssh_enum_pyscript de enumeración de usuarios SSH basado en diferencias de timing y respuestas de autenticación. Explota el mismo vector que CVE-2018-15473 en versiones vulnerables de OpenSSH (≤ 7.7), aunque también puede revelar patrones en configuraciones modernas.
SSH user enumeration script based on timing differences and authentication responses. Exploits the same vector as CVE-2018-15473 in vulnerable versions of OpenSSH (≤ 7.7), although it can also reveal patterns in modern configurations. Works with Python 3 + Paramiko and supports:
Banner pre-reading to avoid EOF/NoBanner errors.
Retries per attempt and cooldown between users (to evade tarpits/MaxStartups).
Autotune of parameters (-m, -t) based on target jitter.
⚠️ Ethical Use
This script should only be used in environments you own or with explicit authorization. Abuse against external systems without permission may be illegal.
📖 Basic usage ./ssh_enum_py3.py -i -u users.txt -m <multiplier_ms> -t
Example: ./ssh_enum_py3.py -i 149.210.234.234 -u users.txt -m 5000 -t 8
⚙️ Options -i, --ip Target host/IP (required) -p, --port SSH port (default: 22) -u, --userlist File with list of users (one per line)
-a, --autotune Calculate recommended parameters (multiplier and threshold) -m, --multiplier Threshold in milliseconds above the local median -t, --threshold Minimum number of "votes" (attempts exceeding the cutoff)
--attempts Attempts per user (default: 12) --timeout Connection/authentication timeout (s, default: 6) --banner-timeout Timeout to read the SSH banner (s, default: 12) --delay Pause between attempts for the same user (s, default: 0.6) --cooldown-users Pause between users (s, default: 0) --retries Retries per attempt in case of banner/transport error
🚀 Usage examples
Output:
[*] Autotune suggested: multiplier (ms): 4986 threshold : 8 baseline_med : 3586 ms (avg=3596 ms) error mix : {'AuthFailed': 12}
Autotune + enumeration in the same run
./ssh_enum_py3.py -i 149.210.234.234 -a -u users.txt
--timeout 12 --banner-timeout 30 --delay 3 --cooldown-users 15
Direct enumeration with fixed parameters
./ssh_enum_py3.py -i 149.210.234.234 -u users.txt -m 4986 -t 8
--attempts 10 --timeout 12 --banner-timeout 30 --retries 5 --delay 3 --cooldown-users 15
📋 Result interpretation
likely VALID → User probably exists (exceeded cutoff in ≥ threshold attempts).
likely INVALID → User probably does not exist (consistent "AuthFailed" responses).
errors={...} → summary of codes:
AuthFailed: normal SSH response.
NoBanner: server terminated before banner (tarpit, MaxStartups, WAF).
TransportError: network/timeout error.
