📡 SNMP Footprinting & Enumeration¶

Simple Network Management Protocol (SNMP) is widely used for monitoring and managing network devices (routers, switches, servers, printers, IoT devices, etc.). Because many devices expose SNMP publicly with default or weak community strings, SNMP becomes a treasure‑trove of information for both attackers and defenders.

1. Why SNMP is a High‑Value Target¶

• Rich Asset Data: Each device can disclose hardware model, OS version, interface list, routing tables, running processes, and even configuration files.
• Default Communities: The majority of devices ship with public/private community strings. If unchanged, they grant read‑only or read‑write access to the MIB tree.
• Passive Reconnaissance: SNMP queries are UDP‑based and relatively low‑volume, making them difficult to detect with traditional IDS.
• Pivot Point: Knowledge gleaned from SNMP often reveals internal IP ranges, VLAN IDs, and other services that can be later targeted.

2. Basic SNMP Enumeration Commands¶

Tip: When scanning many hosts, wrap the above commands in a loop or use tools like masscan to discover open UDP 161 ports first.

3. Nmap Scripting Engine (NSE) for SNMP¶

Nmap ships with a suite of SNMP‑related scripts that automate discovery and vulnerability checks.

# Quick SNMP version & community discovery
nmap -sU -p161 --script snmp-info <target>

# Brute‑force community strings (uses a wordlist)
nmap -sU -p161 --script snmp-brute --script-args snmp-brute.communities=communities.txt <target>

# Enumerate interfaces, routing tables, and more
nmap -sU -p161 --script snmp-netstat,snmp-interfaces,snmp-processes <target>

Common NSE Scripts:

• snmp-info – identifies SNMP version and device type.
• snmp-brute – tries a list of community strings.
• snmp-interfaces – pulls interface details.
• snmp-netstat – shows routing tables.
• snmp-processes – attempts to list running processes (requires read‑write access).

snmpwalk¶

snmpwalk is a classic Net‑SNMP utility that iteratively queries the SNMP agent for each OID under a given root. It is useful for dumping the entire MIB tree (or a subtree) to discover what information the device exposes.

Basic syntax

snmpwalk -v2c -c public <target> .1

• -v2c – use SNMPv2c (most devices still accept it).
• -c public – community string (replace with your own).
• <target> – IP or hostname.
• .1 – start OID (root). You can limit to a specific branch, e.g. .1.3.6.1.2.1.1 for system info.

Example output (truncated)

iso.3.6.1.2.1.1.1.0 = STRING: "Linux myrouter 4.19.0 ..."
iso.3.6.1.2.1.1.5.0 = STRING: "myrouter"
iso.3.6.1.2.1.2.2.1.2.1 = STRING: "GigabitEthernet0/0"

You can pipe the output to grep to find interesting OIDs, e.g. snmpwalk -v2c -c public 10.10.10.25 .1.3.6.1.2.1.1 | grep sysDescr.

onesixtyone¶

onesixtyone is a fast UDP scanner optimized for SNMP community‑string brute‑forcing. It sends a minimal SNMP request to each target and checks the response.

Typical usage

onesixtyone -c communities.txt -i hosts.txt

• -c communities.txt – file with a list of community strings (one per line).
• -i hosts.txt – file with target IPs or CIDR ranges.

Example output

10.10.10.25 public
10.10.10.30 private

The tool reports only successful community matches, making it easy to feed results into later enumeration tools like snmpwalk.

braa¶

braa (BRute snmp Attack) is a newer SNMP brute‑force and enumeration tool written in Go. It not only tries community strings but can also enumerate OIDs once a valid community is found.

Usage

braa -c communities.txt -t 10.10.10.25

• -c – community list.
• -t – single target (you can also use -i for a file).

What it does

1. Attempts each community; on success it prints the community.
2. Optionally runs an OID walk (-w) to dump the MIB tree.
3. Supports SNMPv1/v2c and can output JSON for further processing.

Example

[+] 10.10.10.25 : public (valid)
[+] OID 1.3.6.1.2.1.1.5.0 = STRING: "router01"
[+] OID 1.3.6.1.2.1.2.2.1.2.1 = STRING: "eth0"

4. Metasploit Modules¶

Metasploit provides several auxiliary modules for SNMP:

msfconsole
use auxiliary/scanner/snmp/snmp_walk
set RHOSTS 10.10.10.0/24
set COMMUNITY public
run

Other useful modules:

• auxiliary/scanner/snmp/snmp_login – brute‑forces community strings.
• auxiliary/scanner/snmp/snmp_enum – gathers extensive system information.

5. Advanced SNMP Tools¶

6. Sample Workflow (Step‑by‑Step)¶

1. Discovery – Identify hosts with UDP 161 open.

   masscan -pU:161 10.0.0.0/16 --rate 1000 -oL snmp_hosts.txt
   

2. Community Guessing – Use snmp-brute or onesixtyone.

   onesixtyone -c communities.txt -i snmp_hosts.txt
   

3. Information Harvesting – Run snmpwalk / snmpcheck.

   snmpcheck -c public -t 10.10.10.25 > snmp_report.txt
   

4. Correlate Data – Map interfaces to IP ranges, identify default passwords, and feed results into a central asset inventory.

7. Defensive Countermeasures¶

• Change Default Communities – Use strong, non‑guessable community strings. Rotate them regularly.
• Restrict Access – Limit SNMP to trusted management subnets (firewall ACLs).
• Upgrade to SNMPv3 – Provides authentication (HMAC) and encryption (DES/AES). Disable v1/v2c where possible.
• Monitor UDP 161 – Deploy IDS/IPS signatures for abnormal SNMP traffic and brute‑force attempts.
• Patch Firmware – Many devices have known SNMP information leaks; keep firmware up‑to‑date.

8. References & Further Reading¶

• SNMP RFC 3411‑3418 – Official protocol specifications.
• Nmap NSE – SNMP Scripts
• snmpcheck GitHub Repository
• Metasploit SNMP Modules

All commands should be executed only against systems you own or have explicit permission to test. Unauthorized probing of SNMP services is illegal and may trigger security alerts.