---
id: 8250
title: "Using strace to monitor SSH connections on Linux"
source_domain: netspi.com
source_url: "https://www.netspi.com/blog/technical-blog/network-pentesting/using-strace-to-monitor-ssh-connections-on-linux/"
published_at: "2014-04-07T00:00:00Z"
tags: ["linux", "ssh", "post-exploitation", "monitoring", "ptrace", "strace"]
phying_url: "https://phying.com/item/8250"
lang: en
---

# Using strace to monitor SSH connections on Linux

## Summary

Instead of replacing SSH binaries on a compromised Linux host, testers can attach strace to running sshd via ptrace and read write() system calls to capture passwords and session content live.

## Intelligence Metadata

- **Sources:** netspi.com
- **Published:** 2014-04-07T00:00:00Z
- **Original:** https://www.netspi.com/blog/technical-blog/network-pentesting/using-strace-to-monitor-ssh-connections-on-linux/
- **Phying News:** https://phying.com/item/8250