> ## Documentation Index
> Fetch the complete documentation index at: https://docs.bytejmp.com/llms.txt
> Use this file to discover all available pages before exploring further.

# SNMP Enumeration

> SNMP enumeration with snmpwalk, onesixtyone, and snmpbulkwalk: community strings, OIDs, and data extraction.

## Discovery

```bash theme={"dark"}
nmap -sU -p 161 TARGET
nmap -sU -p 161 --script=snmp-info TARGET
```

***

## Community String Brute-Force

### onesixtyone

```bash theme={"dark"}
onesixtyone -c /usr/share/seclists/Discovery/SNMP/common-snmp-community-strings.txt TARGET
onesixtyone -c community.txt 10.10.10.0/24
```

### Nmap

```bash theme={"dark"}
nmap -sU -p 161 --script=snmp-brute TARGET
```

### Hydra

```bash theme={"dark"}
hydra -P community.txt TARGET snmp
```

Common strings: `public`, `private`, `manager`, `community`.

***

## snmpwalk

### v1

```bash theme={"dark"}
snmpwalk -v1 -c public TARGET
```

### v2c

```bash theme={"dark"}
snmpwalk -v2c -c public TARGET
```

### v3

```bash theme={"dark"}
snmpwalk -v3 -u username -l authPriv -a SHA -A 'authpass' -x AES -X 'privpass' TARGET
```

***

## Useful OIDs

```bash theme={"dark"}
# System info
snmpwalk -v2c -c public TARGET 1.3.6.1.2.1.1

# Hostname
snmpwalk -v2c -c public TARGET 1.3.6.1.2.1.1.5

# Running processes
snmpwalk -v2c -c public TARGET 1.3.6.1.2.1.25.4.2.1.2

# Installed software
snmpwalk -v2c -c public TARGET 1.3.6.1.2.1.25.6.3.1.2

# Open TCP ports
snmpwalk -v2c -c public TARGET 1.3.6.1.2.1.6.13.1.3

# Network interfaces
snmpwalk -v2c -c public TARGET 1.3.6.1.2.1.2.2.1.2

# Users (Windows)
snmpwalk -v2c -c public TARGET 1.3.6.1.4.1.77.1.2.25
```

| OID                      | Data               |
| ------------------------ | ------------------ |
| `1.3.6.1.2.1.1`          | System info        |
| `1.3.6.1.2.1.25.4.2.1.2` | Running processes  |
| `1.3.6.1.2.1.25.6.3.1.2` | Installed software |
| `1.3.6.1.2.1.6.13.1.3`   | Open TCP ports     |
| `1.3.6.1.4.1.77.1.2.25`  | Windows users      |

***

## snmpbulkwalk (Faster)

```bash theme={"dark"}
snmpbulkwalk -v2c -c public TARGET
snmpbulkwalk -v2c -c public TARGET 1.3.6.1.2.1.25.4.2.1.2
```

***

## snmp-check

```bash theme={"dark"}
snmp-check TARGET
snmp-check -c public TARGET
```

Enumerates: system info, users, processes, services, storage, network.

***

## Extended Queries

### Dump Everything

```bash theme={"dark"}
snmpwalk -v2c -c public TARGET . | tee snmp_full.txt
```

### Search for Strings

```bash theme={"dark"}
snmpwalk -v2c -c public TARGET . | grep -i "password\|user\|login\|community"
```

***

## Quick Reference

| Task            | Command                                                 |
| --------------- | ------------------------------------------------------- |
| Brute community | `onesixtyone -c list.txt TARGET`                        |
| Walk v2c        | `snmpwalk -v2c -c public TARGET`                        |
| Processes       | `snmpwalk -v2c -c public TARGET 1.3.6.1.2.1.25.4.2.1.2` |
| Users           | `snmpwalk -v2c -c public TARGET 1.3.6.1.4.1.77.1.2.25`  |
| Full dump       | `snmpwalk -v2c -c public TARGET .`                      |