Enumerate SSH with nmap#
nmap --script=ssh2-enum-algos,ssh-hostkey,ssh-auth-methods -p 22 $IPAudit SSH with ssh-audit#
ssh-audit $IP -p 22Convert SSH key for John#
ssh2john id_rsa > id_rsa.hashTest username behavior#
ssh -o PreferredAuthentications=none username@$IPPivoting#
Use Tunneling.