Documentation Index
Fetch the complete documentation index at: https://docs.bytejmp.com/llms.txt
Use this file to discover all available pages before exploring further.
Discovery
nmap -sU -p 161 TARGET
nmap -sU -p 161 --script=snmp-info TARGET
onesixtyone
onesixtyone -c /usr/share/seclists/Discovery/SNMP/common-snmp-community-strings.txt TARGET
onesixtyone -c community.txt 10.10.10.0/24
Nmap
nmap -sU -p 161 --script=snmp-brute TARGET
Hydra
hydra -P community.txt TARGET snmp
public, private, manager, community.
snmpwalk
snmpwalk -v1 -c public TARGET
v2c
snmpwalk -v2c -c public TARGET
snmpwalk -v3 -u username -l authPriv -a SHA -A 'authpass' -x AES -X 'privpass' TARGET
Useful OIDs
# System info
snmpwalk -v2c -c public TARGET 1.3.6.1.2.1.1
# Hostname
snmpwalk -v2c -c public TARGET 1.3.6.1.2.1.1.5
# Running processes
snmpwalk -v2c -c public TARGET 1.3.6.1.2.1.25.4.2.1.2
# Installed software
snmpwalk -v2c -c public TARGET 1.3.6.1.2.1.25.6.3.1.2
# Open TCP ports
snmpwalk -v2c -c public TARGET 1.3.6.1.2.1.6.13.1.3
# Network interfaces
snmpwalk -v2c -c public TARGET 1.3.6.1.2.1.2.2.1.2
# Users (Windows)
snmpwalk -v2c -c public TARGET 1.3.6.1.4.1.77.1.2.25
| OID | Data |
|---|
1.3.6.1.2.1.1 | System info |
1.3.6.1.2.1.25.4.2.1.2 | Running processes |
1.3.6.1.2.1.25.6.3.1.2 | Installed software |
1.3.6.1.2.1.6.13.1.3 | Open TCP ports |
1.3.6.1.4.1.77.1.2.25 | Windows users |
snmpbulkwalk (Faster)
snmpbulkwalk -v2c -c public TARGET
snmpbulkwalk -v2c -c public TARGET 1.3.6.1.2.1.25.4.2.1.2
snmp-check
snmp-check TARGET
snmp-check -c public TARGET
Extended Queries
Dump Everything
snmpwalk -v2c -c public TARGET . | tee snmp_full.txt
Search for Strings
snmpwalk -v2c -c public TARGET . | grep -i "password\|user\|login\|community"
Quick Reference
| Task | Command |
|---|
| Brute community | onesixtyone -c list.txt TARGET |
| Walk v2c | snmpwalk -v2c -c public TARGET |
| Processes | snmpwalk -v2c -c public TARGET 1.3.6.1.2.1.25.4.2.1.2 |
| Users | snmpwalk -v2c -c public TARGET 1.3.6.1.4.1.77.1.2.25 |
| Full dump | snmpwalk -v2c -c public TARGET . |