SSHOW - Implementation (cont.)


Username length

if (session->state == 0 && session->protocol == 1 &&
    ((session->history.directions >> skip) & 7) == 5 &&
    plain_range->min == 0 &&
    get_history(session, skip + 1)->plain_range.min > 4 &&
    get_history(session, skip + 2)->plain_range.min == 0)

Output:

+ 217.155.34.193:24998 -> 204.181.64.8:22: SSH protocol 1
- 217.155.34.193:24998 <- 204.181.64.8:22: DATA (262 bytes, 0.00 seconds)
- 217.155.34.193:24998 -> 204.181.64.8:22: DATA (143 bytes, 0.00 seconds)
- 217.155.34.193:24998 <- 204.181.64.8:22: DATA (0 bytes, 0.00 seconds)
- 217.155.34.193:24998 -> 204.181.64.8:22: DATA (11 bytes, 0.00 seconds)
- 217.155.34.193:24998 <- 204.181.64.8:22: DATA (0 bytes, 0.00 seconds)
+ 217.155.34.193:24998 -> 204.181.64.8:22: GUESS: Username length is 7