HASSH
A network fingerprinting standard that identifies SSH client and server implementations via MD5 hashes of algorithm sets.
What is HASSH?
HASSH is a network fingerprinting standard that identifies SSH client and server implementations by creating MD5 hashes from the algorithms exchanged during SSH connection setup. It solves the problem of accurately identifying SSH software beyond IP addresses, which can be obscured by NAT or shared across multiple clients.
Security engineers, network defenders, and forensic analysts who need to monitor SSH traffic for malicious activity, detect compromised systems, or enforce SSH client policies in controlled environments.
Developers choose HASSH because it provides a standardized, lightweight method to fingerprint SSH implementations with high accuracy, enabling detection of stealthy attacks, IoT devices, and malicious tools that traditional IP-based monitoring misses.
Overview
HASSH is a network fingerprinting standard which can be used to identify specific Client and Server SSH implementations. The fingerprints can be easily stored, searched and shared in the form of a small MD5 fingerprint.
Use Cases
Best For
- Detecting SSH brute force attacks from NATed or botnet IPs
- Identifying lateral movement attempts using tools like Empire or Metasploit
- Monitoring for covert data exfiltration over SSH channels
- Enforcing approved SSH client policies in controlled environments
- Forensic investigations requiring reliable SSH client identification
- Detecting IoT devices communicating via SSH in network traffic
Not Ideal For
- Environments where SSH traffic is minimal or not used, such as web-only applications
- Teams needing real-time, automated threat response with built-in blocking mechanisms
- Projects requiring fingerprinting for non-SSH protocols like TLS or HTTP
- Organizations with frequently updated SSH clients that change algorithm sets often
Pros & Cons
Pros
Uses SSH_MSG_KEXINIT algorithm sets to create unique MD5 hashes, enabling precise identification of client and server implementations beyond superficial client strings.
Identifies malicious tools like Paramiko or Meterpreter used in exploits, as shown in the README with specific hassh examples for these implementations.
Detects data exfiltration attempts hidden within SSH_MSG_KEXINIT packets, addressing a gap in traditional packet analyzers that don't log such clear-text packets.
Recognizes fingerprints from embedded systems like cameras or keyloggers, useful for spotting hidden devices communicating over SSH in network traffic.
Cons
The Salesforce repository is no longer actively maintained; users must rely on the Corelight fork, which may lead to fragmentation or delayed updates.
Relies on MD5 hashing, which is cryptographically weak and prone to collisions, potentially affecting the long-term reliability of fingerprints.
Limited to SSH traffic only, making it ineffective for networks monitoring other protocols or requiring comprehensive traffic analysis solutions.
Frequently Asked Questions
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.