: Unveiling the Art of Breaching SSH Servers in Bug Bounties: A Dive into Cybersecurity Exploits

: Unveiling the Art of Breaching SSH Servers in Bug Bounties: A Dive into Cybersecurity Exploits

Mass-Breaching SSH Password authentication with nuclei over 120k Bounties 6Servers has been Fixed already

So the thing is if a target has password authentication on SSH it can be an extreme issue wich could lead to root remotet code execution but the common usernames i was able to find in the wild that are missed a lot are azureuser azure and azureadmin. This are usually servers hosted ion Microsft cloud and developers tend to use these as deafault usernames so even if u get the password write and the username is azureuser and password root and u have the password root u can still missout a critical root RCE. secondly when you find ssh servers with password authentication it needs a bit of patients. SO what we did here is we scraped the entire hackerone programs paid once of course with ssh servers wich allow password authentication this was just writing a script wich ussses rate limit according to shodan Enterprise API-rate limit so after scraping all hackerone programs assets with port 22 open this allowed us to run ssh-password-auth.yaml by princechaddha which check if the ssh server suppots password authentication u can find it in nuclei-templates/javascript/enumeration/ssh/ssh-password-auth.yaml

after geting this numerous servers whith password authentication allowed we could look for once hosted on azure and check for week credentials using default or common usernames like azureuser i have mentioned above and common passwords and sometimes switching them a bit like azureadmin and etc. After that going indepth for targe’s specific passwords is when we dig deep into leaked credentials you can go as futher as looking for developers email adresses on hunter.io and phonebook.cz by Intelligence X once you scrap this email adreses i want u to try and use them as ssh usernames as they are
and the second try u remove @domain.com for example the email is ragish.swarez@redacted.com u use ragish.swarez as the username with default and common passwords u can then use a tool like breach-parse to source for username and passwords combinations and try to strip @domain.com on the usernames. take the list of passwords try tehm with ssh default usernames like root,admin and etc thats what we did here and the indepth is shown in our 7million in bounties course

as for the nuclei template its ssh-default-logins.yaml by @tarunKoyalwar which dosent work by default in nuclei u will need to modify your nuclei.ignore file to work with intrusive scripts
nuclei-templates/javascript/enumeration/ssh/ssh-default-logins.yaml this shows how the 7Million in Bug bountie course is exclusive and some of the things are the little thing as other bug bounty hunters say. I will spend the holday talking about how i breach ssh servers on a daily basis maybe a defcon talk hahahah but thats the essance will go more indepth in the course Cyber Matrix Tech