known_hosts cracking

0001-01-01

In response to “Innoculating SSH Against Address-Harvesting Worms”, OpenSSH introduced a feature HashKnownHosts to hash host-related data in known_hosts. This prevents attackers from being able to easily see which hosts a compromised user has connected to in the past, as these are likely to have the user’s public key installed, allowing attackers or malware a ready opportunity to move laterally..

https://github.com/chris408/known_hosts-hashcat?tab=readme-ov-file

http://nms.csail.mit.edu/projects/ssh/sshworm.pdf


Links to this note