One Day Sec

How can I bypass SSH logging mechanisms entirely during a penetration test?

You can bypass most SSH logs by using a 'notty' connection (no pseudo-terminal) via protocols like sftp, scp, or rsync, or by implementing an SSH client that does not allocate a TTY. The article's Python and C# programs demonstrate this technique. A notty connection avoids logging to `/var/log/lastlog`, `/var/log/wtmp`, `/var/run/utmp`, and `~/.bash_history`, making it harder for administrators to detect your session via commands like `last` or `w`. This method is detailed in Penetration Basics - Bypassing SSH Logs.
nottySSH logs bypasspenetration testingsftpscp

Browse all Q&A →