Vulnerabilities
Confirm valid OpenSSH usernames before credential attacks
Username enumeration against OpenSSH via CVE-2018-15473.
overview
What cve-2018-15473 does
Reach for this node after you find an OpenSSH service on 7.7 or earlier and need a validated username list before spraying or brute forcing.
Pass a host plus -w for a wordlist or -u for one name. Set -p for non-default ports and --threads for parallel checks; -v prints valid and invalid results.
Trickest runs the enumerator as a managed Vulnerabilities node that writes confirmed accounts to a file and folder for hydra or medusa.
use cases
Where cve-2018-15473 fits
Enumerate valid SSH accounts
Test a username wordlist against an OpenSSH server and confirm which accounts exist from the server's differing responses to a malformed auth request.
Confirm a single account
Pass one username with -u to check whether a specific account is present, useful when you already have a name to verify.
Narrow a credential attack
Feed validated usernames into password spraying or brute forcing so the attack targets real accounts instead of guessing both user and password.
Reach IPv6 and non-standard ports
Enumerate IPv6 SSH services and services on a non-default port that IPv4-only or port-22-only tools cannot reach.
reference
cve-2018-15473 inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| hostname | STRING | · | Target host or IP to enumerate (positional). |
| usernames | FILE | -w | Wordlist of usernames to test. |
| single-username | STRING | -u | A single username to test. |
| port | STRING | -p | Target SSH port (default 22). |
| threads | STRING | --threads | Number of enumeration threads (default 4). |
| verbose | BOOLEAN | -v | Print both valid and invalid usernames (default false). |
Showing key inputs. cve-2018-15473 exposes 6 inputs in total.
example
Run cve-2018-15473
# test a username wordlist against an OpenSSH service on a custom portpython3 ssh-username-enum.py -p 2222 --threads 8 -w users.txt 198.51.100.24[*] Starting user enumeration on 198.51.100.24:22[*] Loaded 214 usernames from users.txt[+] admin is a valid user[+] deploy is a valid user[+] git is a valid user[-] backup is not a valid user[-] oracle is not a valid user[*] Enumeration complete: 3 valid, 211 invalidguidance
Choosing cve-2018-15473
Use this when an SSH service runs a vulnerable OpenSSH version and you want validated usernames before a credential attack. Confirm the service first with a port scanner, then pass results to hydra or medusa.
hydra
Network login brute forcer. Consumes the validated usernames this tool produces.
medusa
Parallel credential brute forcer. Another consumer of enumerated SSH accounts.
netexec
Multi-protocol credential and enumeration tool. Broader than this single-CVE check.
faq
cve-2018-15473 questions
related
More Vulnerabilities tools
agentsleak
Black Hat Arsenal runtime security for AI coding agents, evaluated offline over recorded action events.
commix
Automates OS command injection detection and exploitation.
dalfox
Parameter mining and XSS testing with headless verification.
dnsreaper
Subdomain takeover scanner with cloud-zone intake.
find-gh-poc
Locate public CVE proof-of-concept repositories on GitHub.
golemhalt
Black Hat Arsenal reference monitor for coding agents, inventoried as a policy and provider corpus.
Run cve-2018-15473 yourself
An SSH host and a username wordlist feed the enumerator, which exploits CVE-2018-15473 to confirm real accounts and writes the valid usernames as output.
Facts on this page come from the live Trickest tool library.