SNMP Enumeration

← Stage index · Cheatsheet | Strategy map | Study methods: Extract opportunities from services

Recognize: SNMP queries commonly use UDP/161. Versions 1 and 2c authenticate with a community string sent without modern transport protection; version 3 can provide user-based authentication and privacy. Goal: turn a valid read context into host, interface, route, process, software, user and listener clues.

Baseline: find a read community, then walk

onesixtyone -c COMMUNITY_FILE TARGET
snmpwalk -v2c -c COMMUNITY TARGET 1.3.6.1.2.1

Use -v1 instead when version 1 is indicated. Start with the standard system tree before a huge full walk.

Decisive output: returned OID/value pairs prove that the selected version/community can read those objects. Hostnames, interfaces, routes, users, processes and locally listening ports become new hypotheses to validate through the appropriate service or post-access path.

Variant — efficient v2c bulk walk

snmpbulkwalk -v2c -c COMMUNITY TARGET 1.3.6.1.2.1

Bulk requests reduce round trips but require SNMPv2c or later. If the agent rejects them, fall back to snmpwalk with the verified version.

Variant — high-value Windows OIDs

snmpwalk -v1 -c COMMUNITY TARGET 1.3.6.1.4.1.77.1.2.25
snmpwalk -v1 -c COMMUNITY TARGET 1.3.6.1.2.1.25.4.2.1.2
snmpwalk -v1 -c COMMUNITY TARGET 1.3.6.1.2.1.25.6.3.1.2
snmpwalk -v1 -c COMMUNITY TARGET 1.3.6.1.2.1.6.13.1.3

These target user names, running process names, installed software and TCP listener ports. Availability depends on the agent and exposed MIB view.

Variant — SNMPv3 authenticated and private walk

snmpwalk -v3 -l authPriv -u USER -a SHA -A AUTH_PASSWORD -x AES -X PRIV_PASSWORD TARGET 1.3.6.1.2.1

The security level, authentication algorithm, privacy algorithm and credentials must match the configured SNMPv3 user. authNoPriv authenticates without encryption; noAuthNoPriv supplies neither and should be used only when that exact configuration is observed.

Variant — focused UDP verification

sudo nmap -sU -sV -p 161 --script snmp-info TARGET

snmp-info extracts basic SNMPv3 engine information without proving a usable v1/v2c community.

Failure cues: UDP silence can remain open|filtered; it does not prove that the community is wrong. Timeout: No Response can be version mismatch, wrong community, filtering, loss or an unavailable OID view. No Such Object means the queried OID is absent/not exposed, not that the whole service failed. Do not use a discovered write community to change configuration during enumeration.

Next action: translate output into exact host/service/user hypotheses, scan newly disclosed in-scope addresses/listeners from the proper source position, and keep configuration-changing SNMP actions outside this stage.