“We’re already here and the SSH key is right there. If we print it out to the web application’s terminal, we can immediately copy it to our Teamserver. Then, we can authenticate to the web server via SSH. It’s a risk I’m willing to take.”
Your team member looks concerned.
“I hope you have thought this through” he says.
You execute the command to print out the contents of the SSH key:
You immediately copy the id_rsa key to the Kali teamserver and then log out of the web application. You are now positioned to use the key to authenticate to the web server with an encrypted communication channel.
But something doesn’t sit right with you. You go over the Wireshark output over and over again in your mind. Did you make a mistake by allowing this authentication material to travel across the open internet in an unencrypted form?
The thought bothers you. You wonder if what you just did is going to compromise entire engagement.