Which wordlist works best with ssb?

Point -w at a password list such as rockyou.txt or a set of known-breached credentials. One candidate per line. A focused list beats a giant generic one when lockout or rate limits apply.

How do I tune concurrency and retries?

Set -c for simultaneous attempts (default 100). If a server drops connections, lower -c, raise -r retries, and widen -t so slow handshakes are not counted as failures.

Can ssb brute-force SSH on a non-standard port?

Yes. Pass -p with the port, for example -p 2222. Without it ssb connects to port 22.

How does ssb compare to hydra or medusa?

hydra and medusa cover many protocols. ssb does SSH only, with a smaller flag set and high default concurrency when SSH is the single target.

What should run before ssb?

A port scan that confirms SSH is listening, so attempts only hit hosts that expose port 22 (or the alternate port set with -p).

Updated Jul 14, 2026

Passwords

Test SSH passwords from a wordlist

SSH password brute-forcing from a host, user, and wordlist.

Test SSH for weak credentials Brute-force discovered SSH services Tune concurrency for the target

overview

What ssb does

ssb tries each password in a -w wordlist against one SSH host and user, writing any credential that authenticates to a file and folder.

Use it after a port scan shows SSH open. Tune -c for concurrency, -r for retries, and -t for per-attempt timeout when the server throttles.

Unlike hydra or medusa, ssb covers SSH only. Keep the wordlist focused; lockouts and rate limits punish oversized lists.

source github.com/kitabisa/ssb

use cases

Where ssb fits

Test SSH for weak credentials

Run a curated password list against a host and user to surface reused or default logins before an attacker finds them.

Brute-force discovered SSH services

Feed ssb hosts from a port scan that found open port 22 so attempts only hit services that exist.

Tune concurrency for the target

Raise or lower -c and the retry count to push throughput on a tolerant server or stay gentle on a fragile one.

Audit your own fleet

Point ssb at your own hosts with a breached-password list to confirm none of them accept a known-bad credential.

reference

ssb inputs and flags

8 inputs

Name	Type	Flag	Description
host	STRING	·	Target SSH host to brute-force.
user	STRING	·	Username to brute-force on the target.
wordlist	FILE	-w	Path to the password wordlist file.
port	STRING	-p	Port to connect to on the remote host (default 22).
concurrent	STRING	-c	Concurrency / thread level (default 100).
retries	STRING	-r	Number of connection retries (default 1).
timeout	STRING	-t	Connection timeout (default 30s).

Showing key inputs. ssb exposes 8 inputs in total.

Full flag reference (8 inputs)

Name	Type	Flag	Description
host	STRING	·	Target SSH host to brute-force.
port	STRING	-p	Port to connect to on the remote host (default 22).
user	STRING	·	Username to brute-force on the target.
retries	STRING	-r	Number of connection retries (default 1).
timeout	STRING	-t	Connection timeout (default 30s).
verbose	BOOLEAN	-v	Verbose mode; log each attempt as it runs.
wordlist	FILE	-w	Path to the password wordlist file.
concurrent	STRING	-c	Concurrency / thread level (default 100).

example

Run ssb

ssb · command

# brute-force SSH on a discovered host with a password listssb -w /usr/share/wordlists/rockyou.txt -c 200 -r 2 -t 15 -p 2222 root@198.51.100.23

sample output

[*] target 198.51.100.23:2222  user: root  wordlist: rockyou.txt (14344392 words)[-] root:123456[-] root:password[-] root:12345678[-] root:letmein[+] valid credential found -> root:S3cr3t-Autumn![*] 1 credential recovered, 4812 tries in 00:02:41

guidance

Choosing ssb

Use ssb when SSH is open and you need to test one host and user against a password wordlist. For other protocols, use a multi-protocol cracker. Confirm the port first, and only on authorized hosts.

hydra

Multi-protocol cracker. Prefer ssb when SSH is the only target.

medusa

Parallel multi-protocol brute-forcer. ssb keeps a smaller SSH-only flag set.

faq

ssb questions

A host, a user, and a -w wordlist of passwords. ssb tries each candidate against the SSH service and reports any that authenticate.

Run ssb yourself

A host and a wordlist feed ssb, which brute-forces the SSH login and writes any valid credential as output.

Run ssb in Trickest Browse the library

Facts on this page come from the live Trickest tool library.