bssh

Browse for SSH servers

$ bssh

$ bssh --vnc

$ bssh --shell

$ bssh --domain [domain]

bssh [-v] -h -u -p [-P ] [-t ] [-i ]

-v
    Verbose mode. Displays additional information during the attack.

-h
    The hostname or IP address of the target SSH server.

-u
    Path to a file containing a list of usernames, one username per line.

-p
    Path to a file containing a list of passwords, one password per line.

-P
    The port number of the SSH server. Defaults to 22 if not specified.

-t
    The number of threads to use for the attack. Increase to speed up the attack, but too many threads may overwhelm the target server.

-i
    Path to an identity file (private key). Will try password authentication first

bssh is a simple, command-line tool for brute-forcing SSH passwords.

It operates by attempting to connect to a specified SSH server with a list of usernames and passwords provided in separate files (or a combined username:password file). bssh iterates through the provided combinations, attempting authentication until a successful login is achieved, the entire list is exhausted, or interrupted by the user.

It is critically important to understand that using bssh against systems without explicit authorization is illegal and unethical. This tool should only be used for testing purposes on systems you own or have explicit permission to test. Using this tool maliciously can have severe legal and reputational consequences.

bssh is a rudimentary tool and may be detected by modern intrusion detection systems.
It is susceptible to account lockout policies if the target server has them configured.
Rate limiting threads and understanding the target SSH configuration is important when using this tool to avoid detection or lockout.
Password spraying is recommended against lockout policies.

Prioritize ethical and legal considerations. Only use bssh on systems where you have explicit authorization. Unauthorized access is a serious crime.

bssh helps highlight the importance of strong passwords and robust security configurations. Employ strong password policies, multi-factor authentication, and intrusion detection systems to protect your systems.

ssh(1), hydra(1), ncrack(1)