Audit SSH algorithms on port 22

Overview

SSH weakness is visible before anyone authenticates. The server sends its key exchange list in the clear. This workflow enumerates hosts, connects to port 22, sends a banner, and reads KEXINIT. It flags broken host keys, SHA1 key exchange, CBC and legacy ciphers, and weak MACs. It does not try a password and it does not offer a key. Point it at a domain you are authorised to test, and treat a weak algorithm as a hardening ticket in exposure management.

Pipeline

1. subfinder enumerates hosts for the domain you set.
2. banner reads the SSH banner on port 22, on at most 80 hosts. It does not log in.
3. kex reads KEXINIT only for hosts that answered.
4. weak-kex and weak-cipher flag weak algorithms. Terrapin-mitigation markers are not treated as weak key exchange.
5. report writes findings.jsonl, one row per weak algorithm, plus a summary.

Inputs

• Domain. Set on the subfinder node. Hosts come from that enumeration.

Outputs

• findings.jsonl. One JSON line per host with a weak algorithm, plus a summary.

Integrations

• Subfinder. Host enumeration for the domain.

Sample output

The line below is the summary from a completed run on brokencrystals.com on 2026-09-24. Subfinder returned 74 hosts. None answered with an SSH banner on port 22, so there is no key-exchange finding.

kind	targets	ssh_endpoints	high	pqc_ready	scanned_at
summary	0	0	0	0	2026-09-24T10:21:53Z

FAQ

Does this attempt a login?

No. It reads the banner and the algorithm list. It does not send a password or a key.

Which algorithms are weak?

ssh-dss and ssh-rsa host keys, SHA1 key exchange, CBC and legacy ciphers, and MD5 or SHA1 MACs.

How many hosts are checked?

At most 80 hosts from the subfinder output.

Where should I run it?

On a domain you are authorised to test.

Related workflows

• Exposed Database Scanner. Reach for this when the open service is a database rather than SSH.
• Full Network Port and Service Assessment. Reach for this when you need the wider port inventory, not the SSH algorithm list.