Enumerate SSH with nmap#
nmap --script=ssh2-enum-algos,ssh-hostkey,ssh-auth-methods -p 22 $IP
Audit SSH with ssh-audit#
ssh-audit $IP -p 22
Convert SSH key for John#
ssh2john id_rsa > id_rsa.hash
Test username behavior#
ssh -o PreferredAuthentications=none username@$IP
Pivoting#
Use [Tunneling](<tunneling>).