最新版本OpenSSH服务在接收到畸形的认证请求包时,会根据用户名的存在与否给出不同的响应,由此导致通过SSH服务枚举服务器的用户名。
ssh-check-username.py 使用说明
- 安装依赖包
pip install paramiko==2.0.8
- 语法:
python ssh_checkusername.py ip username –port 22
脚本
#!/usr/bin/env python
# Copyright (c) 2018 Matthew Daley
#
# Permission is hereby granted, free of charge, to any person obtaining a copy
# of this software and associated documentation files (the "Software"), to
# deal in the Software without restriction, including without limitation the
# rights to use, copy, modify, merge, publish, distribute, sublicense, and/or
# sell copies of the Software, and to permit persons to whom the Software is
# furnished to do so, subject to the following conditions:
#
# The above copyright notice and this permission notice shall be included in
# all copies or substantial portions of the Software.
#
# THE SOFTW