server. It was developed as a secure replacement for older, insecure protocols such as Telnet and rlogin. Through the use of strong encryption algorithms and key-based authentication, SSH ensures confidentiality and data integrity during sessions.

At its core, SSH operates over the application layer using TCP port 22 by default. The protocol initiates with a handshake where the server presents its public host key, which the client verifies to prevent man-in-the-middle attacks. Upon successful verification, both sides negotiate encryption and compression algorithms, establishing a secure channel.

SSH supports a range of functionalities including remote command execution, secure file transfer protocols (such as SCP and SFTP), forwarding of network ports (tunneling), and multiplexing multiple encrypted channels over a single connection. These capabilities facilitate secure system administration, automation, backups, and development workflows, especially in UNIX/Linux environments, routers, and cloud infrastructure.

19:T645,

Common Vulnerabilities:

Weak or default credentials: Attackers exploit default or easily guessable passwords to gain unauthorized access.
Unrestricted access: Open SSH ports can be targeted for brute-force or credential stuffing attacks.
Outdated SSH server versions: Older versions may have vulnerabilities such as information leakage or susceptibility to downgrade attacks.
Poorly managed host keys: Unverified or reused host keys can enable man-in-the-middle (MITM) attacks.
Improper tunneling controls: SSH tunneling may be abused to bypass network policies or exfiltrate data.

Common Mitigations:

Use strong, unique passwords combined with multi-factor authentication (MFA) or SSH key-based authentication to prevent unauthorized access.
Restrict SSH access to