A dictionary-based SSH password auditing tool for authorized security testing.
Originally created in 2016 by Radovan Brezula as a proof-of-concept SSH brute-forcer. I (Blai Peidro) joined the project that same year and have since completely rewritten the codebase with security hardening, improved resume support, parallel job control, signal-safe process cleanup, and modern bash practices.
In benchmarks against a local host, getsshpass found a password at row 5,000 of rockyou.txt (14.3M lines) in approximately 3 min 29 sec - outperforming THC Hydra (4 min 45 sec with its maximum 64 parallel sessions) using sshpass with only 5 parallel jobs and a 0.04s delay between attempts on the same target.
- Dictionary attack against SSH services using username and password lists
- Automatic filtering to skip users without password authentication enabled
- Parallel SSH attempts with unlimited concurrency by default (configurable with
-j) - Resume capability - interrupted attacks can be continued from where they left off
- Live attempt display with apt-style progress bar pinned at the bottom of the terminal
- Colored terminal output
- Configurable connection timeout and delay between attempts
- Supports both IP addresses and hostnames as targets
- Signal handling with clean process cleanup
- Timestamped log output with standard log levels (
[OK ],[INFO ],[WARN ],[ERROR]) - Built-in wordlist fetching and listing from popular sources (rockyou, SecLists)
Repository layout:
getsshpass/
├── .github/ # GitHub Actions CI, issue/PR templates, and Dependabot config
├── docs/ # In-depth documentation guides
├── src/ # The getsshpass.sh script, wordlist catalog, and runtime state
├── tests/ # bats unit and integration test suites
├── .editorconfig # Editor settings (2-space indent, 80 cols)
├── .shellcheckrc # ShellCheck configuration
├── CHANGELOG.md # Version history
├── CONTRIBUTING.md # Contribution guidelines
├── LICENSE # GPLv3+ license
├── README.md # This file
└── SECURITY.md # Security policy and responsible-use notice
- Bash 4.4+ (checked at startup)
- ssh (OpenSSH 8.4+ client required for default SSH_ASKPASS mode; any version works with
-s/--sshpass) - curl (optional, for
--fetchwordlist feature) - sshpass (optional, for
-s/--sshpassmode) - sha256sum or shasum (optional, to verify
--fetchdownloads that pin a checksum)
The script verifies it is running on bash 4.4 or newer and exits with a clear message otherwise (macOS ships bash 3.2 — install a newer bash with brew install bash). It also checks for ssh at startup and exits with a clear error if it is missing. When using the default SSH_ASKPASS mode, it also checks that the OpenSSH client is version 8.4 or newer (required for SSH_ASKPASS_REQUIRE=force) and exits with an error directing the user to -s/--sshpass if not.
If -s/--sshpass is used, the script checks for sshpass at startup and exits if it is missing.
In-depth guides live in the docs/ folder:
- Usage - steps, all options, examples, and sample output
- How it works - the SSH_ASKPASS and sshpass mechanisms, the attack loop, and performance tuning
- Wordlists - wordlist format, and fetching or adding lists (
--fetch/--list) - State and resume - signal handling, per-host state files, and resuming interrupted runs
- Troubleshooting - common errors and messages, and how to fix them
- Testing - running the unit and integration suites
This project follows the Google Shell Style Guide. See CONTRIBUTING.md for details.
See CHANGELOG.md for full version history.
- Radovan Brezula (brezular) - original author
- Blai Peidro - co-author
GPLv3+ - GNU General Public License version 3 or later. See LICENSE for details.
This tool is intended for authorized security auditing and penetration testing only. Unauthorized access to computer systems is illegal. Always obtain proper written authorization before testing any system you do not own.