TechKnowSurge
Cisco CCNA 4.8 Cisco CCNA 2.8 Cisco CCNA 5.1
TechKnowSurge Catalog Videos DEMO: SSH Hopping
VideoNetworkFree

DEMO: SSH Hopping

SSH hopping is a technique for moving through a network device by device using Secure Shell connections, allowing administrators—and attackers—to reach equipment that isn't directly accessible from a management workstation.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

SSH hopping is a method of traversing a network by establishing sequential Secure Shell sessions, using each connected device as a relay to reach the next. When routing isn't fully configured across all network segments—for example, when a Layer 3 switch lacks awareness of adjacent router networks—a management workstation may not have a direct path to every device. By SSHing into the first reachable device and then initiating a new SSH session from within that connection to the next device, it becomes possible to move progressively through the network, segment by segment, without requiring end-to-end routing between the management host and every endpoint. This technique has direct relevance to both network administration and cybersecurity. From an operational standpoint, it enables administrators to configure and manage devices that would otherwise be unreachable from a central workstation during the early stages of network setup or in environments with incomplete routing. From a security standpoint, SSH hopping closely mirrors the lateral movement techniques used by attackers who gain an initial foothold on one device and then exploit existing connectivity to pivot deeper into the network infrastructure. Understanding how this method works—and recognizing the access pathways it exploits—is a foundational part of designing, auditing, and hardening enterprise network environments.

What you'll learn

What's covered

SSH Hopping Through Network

Aligned to

Cisco CCNA
4.8 Configure network devices for remote access using SSH
2.8 Describe network device management access
5.1 Define key security concepts

Key terms

Secure Shell
SSH
A cryptographic network protocol that provides secure remote login and command execution over an unsecured network.
Lateral Movement
A technique used by attackers to progressively move through a network by accessing additional systems after gaining an initial foothold.
Network Segmentation
The practice of dividing a network into smaller segments to improve performance and limit the spread of security threats.
Privilege Escalation
An attack that exploits vulnerabilities to gain higher-level access than originally authorized.
Router
A network device that forwards data packets between networks based on IP addresses.
SSH Hopping
A technique of chaining sequential SSH connections through intermediate network devices to reach systems that are not directly accessible from the origin host.

Topics

Ssh Lateral Movement Network Security Penetration Testing Networking Remote Access

Transcript

I don't know that you'll actually be tested on anything like this in the CCNA exam, but it is information that can be helpful when it comes to administering your networks, especially when it comes to hacking. A hacker would leverage some sort of piece of equipment to start gaining access to other pieces of equipment. It creates a hot point to access the rest of the network. And that's what we're going to do right now.

We don't have OSPF up and running on all of our devices, so I can't just hop from my management network and have access to all of the equipment. However, between the devices we already have some sort of connectivity. So I'm going to hop from device to device, program each one of these devices.

The network

This is my network right here. I have this layer 3 switch and I have three routers that are right here. In our last module we set up the connectivity between these routers, so if I could console into any of these routers I could ping the other side, I could ping this interface. But because this layer 3 device right here, this layer 3 switch, doesn't know of any of these other networks, I am not going to be able to connect to any of those networks.

In fact, even here, if I were to try to access this router 1 from my demo laptop, what would happen is it would make a connectivity, it would send, let's say I'm pinging, it would send a ping all the way up to this router. However, this router is not aware of any of these VLANs down here, so this router wouldn't know how to get back to my computer. So I can't make connectivity directly back to this computer.

So what I'm going to do is I'm going to SSH into this switch right here, and then on this switch I'll SSH into this router, and then from this router I'll SSH into this router, and so on and so forth.

Hopping from the switch into router 1

The first step that I'm going to do is I'm going to SSH into this switch. Well, I've already got this, that's what this window is up right here. I'm SSH'd into headquarters switch 1, so I've got that first step done.

The next thing that I'm going to do is I'm going to SSH from this switch to this router. Now I need to know what the IP address is of this router, so I have my IP cheat sheet over here on the right hand side, and this is HQ SW1, this is the R1. So I'm going to go to 10.240.0.2. Now this router also has a 1040.2.1, that's this other side, but I can't SSH into that from the switch, because this switch is not aware of this network right here.

In fact, I could actually test this out. I can do a ping, and I'm going to 10.240.2 1.1. I'll hit enter, and we'll see that this is going to time out and is not working. So there's that. And then what I'm going to do is I'm going to ping zero zero zero, and we can see that we do have connectivity to 1040.0.2. So I can SSH into that.

So I'm going to do SSH, and then we do a dash L, and that's going to be so I can enter in my username. So dash L, and then my username, which is Andrew, and then 10.240.0.2. So I can SSH into that and then hit enter. It's asking for a password, so I'll copy my password here, paste it into here, and now I'm on router 1.

Hopping on to R2 and R3

So next one I'm going to do is I'm going to hop from R1 to R2. So I'll pull up my diagram here. Same thing, I can go from R1 to R2, but I have to go to this interface right here, this IP address, because this router is aware of this network, it's just not aware of this network right here. So I'm going to, well actually it looks like it's a dot, oh yes, it's dot one. So dot one, and then I do need to put in here dash L Andrew, and then I'm making the jump to, there it is. The same password here, so I'm going to paste that into there, and now I'm on R2.

And then I could do the same thing to R3. So SSH 10.240.3.2 would be for router 3, and do need to get my name in there, hit enter, I'll copy this password, paste. So there you have it, now I'm on router 3. So although I don't have direct connectivity from my demo laptop, I've been able to leverage each one of these links to get to the next network.

So that is SSH hopping. That's, once again, something a hacker would do to break into your network: leverage different openings in your network, or different protocols, or be able to leverage one piece of equipment to get into the next piece of equipment. So that's one thing you need to keep in mind from a security perspective. But it's certainly helpful that we're doing this right now when it comes to being able to access and remotely manage our network as well.

And the last thing that I need to do is I need to peel back these layers as well. So to get out of these, I'm going to hit exit and I'll go back a layer, exit again, and then exit again.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →