Passive SSH is an open source framework composed of a scanner and server to store and lookup the SSH keys and fingerprints per host (IPv4/IPv6/onion).
The key materials along fingerprints and hosts are stored in a fast-lookup database. The system provides an historical view of SSH keys seen but also common key materials reused on different IP addresses.
Related paper for this work: Active and Passive Collection of SSH Key Material for Cyber Threat Intelligence.
- A simple SSH scanner
- A server storing key materials in a Redis database
- A simple ReST API to lookup by SSH fingerprints (including hassh or host (IPv4, IPv6 or onion addresses)
- Statistics of SSH banners and SSH fingerprints
- Python >= 3.6
- Redis >5.0
- tornado
- Python >= 3.6
- D4 paramiko
- pysocks (required to scan Tor hidden services)
./install.sh
- Install Redis and all pythons requirements.
- All Python 3 code will be installed in a virtualenv (PSSHENV).
The ssh scanner can be used with a Tor proxy to scan a host or an hidden service.
Don't forget to install the Tor proxy if you want to scan Tor hidden services: sudo apt-get install tor -y
Launch the redis and the tornado server:
./LAUNCH -l
A SSH scanner is included to scan small networks or internal infrastructure.
. ./PSSHENV/bin/activate
cd bin/
# Scan a host
./ssh_scan.py -t <host: 10.0.0.12>
# Scan a network range
./ssh_scan.py -r <network range: 10.0.0.0/8>
An API is available to query the Passive SSH server.
By default, the tornado server for Passive SSH is running on port 8500.
curl http://localhost:8500/banners
Return server staticstics:
- number of SSH banners
- number of scanned hosts:
- ip
- onion
- number of fingerprints by type
Return all banners ordered by scores
Get hosts by banner:
- banner
- list of hosts
Return the list of all keys types
Return host SSH metadata:
- first seen
- last seen
- ports
- list of banners
- list of fingerprints
Return the SSH history of an host
Return all fingerprints ordered by scores
Get hosts by fingerprint:
- first seen
- last seen
- key type
- key base64
- fingerprint
- list of hosts
Get hosts by type of key and fingerprint:
- first seen
- last seen
- key type
- key base64
- fingerprint
- list of hosts
Return all hasshs ordered by scores
Get hosts by hassh:
- hassh
- list of hosts
- kexinit
- CIRCL Passive SSH - access can be requested if you are a CSIRT member of FIRST.org, TF-CSIRT, CNW network or vetted security researchers.
The software is free software/open source released under the GNU Affero General Public License version 3.
If you want to cite this work, you can cite it as follows: Active and Passive Collection of SSH Key Material for Cyber Threat Intelligence
@article{dulaunoy2022active,
title={Active and Passive Collection of SSH key material for cyber threat intelligence},
author={Dulaunoy, Alexandre and Huynen, Jean-Louis and Thirion, Aurelien},
journal={Digital Threats: Research and Practice (DTRAP)},
volume={3},
number={3},
pages={1--5},
year={2022},
publisher={ACM New York, NY}
}