loading
Loading content
loading
Vulnerabilities
Username enumeration against OpenSSH via CVE-2018-15473.
overview
Reach for this node after you find an OpenSSH service on 7.7 or earlier and need a validated username list before spraying or brute forcing.
Pass a host plus -w for a wordlist or -u for one name. Set -p for non-default ports and --threads for parallel checks; -v prints valid and invalid results.
Trickest runs the enumerator as a managed Vulnerabilities node that writes confirmed accounts to a file and folder for hydra or medusa.
use cases
Test a username wordlist against an OpenSSH server and confirm which accounts exist from the server's differing responses to a malformed auth request.
Pass one username with -u to check whether a specific account is present, useful when you already have a name to verify.
Feed validated usernames into password spraying or brute forcing so the attack targets real accounts instead of guessing both user and password.
Enumerate IPv6 SSH services and services on a non-default port that IPv4-only or port-22-only tools cannot reach.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| hostname | STRING | · | Target host or IP to enumerate (positional). |
| usernames | FILE | -w | Wordlist of usernames to test. |
| single-username | STRING | -u | A single username to test. |
| port | STRING | -p | Target SSH port (default 22). |
| threads | STRING | --threads | Number of enumeration threads (default 4). |
| verbose | BOOLEAN | -v | Print both valid and invalid usernames (default false). |
Showing key inputs. cve-2018-15473 exposes 6 inputs in total.
example
# test a username wordlist against an OpenSSH service on a custom portpython3 ssh-username-enum.py -p 2222 --threads 8 -w users.txt 198.51.100.24[*] Starting user enumeration on 198.51.100.24:22[*] Loaded 214 usernames from users.txt[+] admin is a valid user[+] deploy is a valid user[+] git is a valid user[-] backup is not a valid user[-] oracle is not a valid user[*] Enumeration complete: 3 valid, 211 invalidguidance
Use this when an SSH service runs a vulnerable OpenSSH version and you want validated usernames before a credential attack. Confirm the service first with a port scanner, then pass results to hydra or medusa.
Network login brute forcer. Consumes the validated usernames this tool produces.
Parallel credential brute forcer. Another consumer of enumerated SSH accounts.
Multi-protocol credential and enumeration tool. Broader than this single-CVE check.
faq
related
Automates OS command injection detection and exploitation.
Subdomain takeover scanner with cloud-zone intake.
Locate public CVE proof-of-concept repositories on GitHub.
Decode, forge, crack, and tamper JWTs for auth checks.
Triage reflected special characters on parameterized URLs.
Detect and exploit SQL injection on authorized web targets.
An SSH host and a username wordlist feed the enumerator, which exploits CVE-2018-15473 to confirm real accounts and writes the valid usernames as output.
Facts on this page come from the live Trickest tool library.