jtesta/ssh-audit

Features

• Cryptographic Configuration Analyzers - Analyzes key exchange, MAC, and encryption algorithms used by SSH implementations for security compliance.
• SSH Server Auditing - Identifies weak encryption algorithms and configuration vulnerabilities in servers to ensure secure communication standards.
• Vulnerability Mapping - Links detected encryption and key-exchange algorithms to high-level security standards and hardening guides.
• Cryptographic Primitive Validation - Checks key exchange, encryption, and MAC algorithms against security standards to ensure only safe primitives are used.
• Security and Compliance - Verifies that SSH configurations adhere to predefined hardening standards and organizational security requirements.
• Configuration Policy Validation - Scans configurations against predefined hardening standards or custom policies to ensure adherence to security requirements.
• Cryptographic Algorithm Auditing - Evaluates key-exchange, host-key, encryption, and MAC algorithms to determine if they are unsafe or legacy.
• Security Auditing Tools - Analyzes SSH server and client configurations to identify weak encryption algorithms and security vulnerabilities.
• SSH Security Configurations - Analyzes server and client settings to identify weak encryption algorithms and general configuration vulnerabilities.
• SSH Server Security Scanning - Scans SSH servers to identify weak encryption algorithms and outdated configurations to improve security.
• SSH Client Security Auditing - Evaluates SSH client configurations and software to detect deprecated cryptographic primitives and insecure settings.
• SSH Handshake Probing - Sends specific SSH handshakes to servers to identify supported cryptographic algorithms.
• Client Configuration Auditing - Analyzes SSH client configurations to detect insecure settings and deprecated cryptographic primitives.
• SSH Version Fingerprinting - Identifies the specific SSH software version by matching supported algorithms and banner strings against a known database.
• SSH Banner Identification - Extracts banner information to determine the device, operating system, and specific software version being used.
• Hardening Guides - Provides platform-specific configuration instructions and algorithm recommendations to remediate insecure SSH settings.
• Client Behavior Analysis - Operates a listener to evaluate the configuration and behavior of software attempting to establish a connection.
• Algorithm Hardening Recommendations - Suggests specific encryption and key-exchange algorithms to add or remove based on the detected software version.
• Configuration Hardening - Provides detailed remediation steps and modified algorithm lists to secure SSH installations.
• Payload-Based Exhaustion Techniques - Simulates high-frequency requests to detect susceptibility to CPU exhaustion and other denial-of-service vectors.
• Diffie-Hellman Modulus Validation - Verifies if the server correctly validates and rejects insecure Diffie-Hellman modulus lengths.
• SSH Client Analysis Listeners - Operates a mock SSH server to intercept and analyze the configuration of connecting client software.
• Denial of Service Tools - Measures server resilience against concurrent sockets and CPU exhaustion to identify availability vulnerabilities.
• Connection-Based DoS Testing - Measures how a server handles concurrent sockets to determine susceptibility to denial-of-service vulnerabilities.
• Software Fingerprinting - Determines software compatibility by evaluating supported algorithms and unique fingerprints to identify potential vulnerabilities.
• CPU Exhaustion Testing - Simulates CPU exhaustion attacks to determine if a target is vulnerable to specific denial-of-service vectors.
• Network Perimeter Defense - Audits SSH server configurations to provide security posture recommendations.
• SSH Security Tools - Tool for auditing SSH server and client configurations.

Star history