# SNMP

> Network monitoring and management

- **URL:** https://hackindex.io/services/snmp
- **Type:** Service
- **Default ports:** 161, 162
- **Tags:** snmp, network, udp, monitoring, linux, enumeration
- **Published:** 2025-12-31
- **Updated:** 2026-07-13

SNMP (Simple Network Management Protocol) runs on **UDP port 161** (agent queries) and **UDP port 162** (traps/notifications). Nmap identifies it as `snmp`. SNMP is used to monitor and manage network devices, servers, printers, and IoT equipment.

SNMP v1 and v2c use community strings as passwords, transmitted in cleartext. The defaults (`public` for read, `private` for read-write) are left unchanged on a surprising number of devices. A valid read community string exposes system information, network interfaces, ARP tables, routing tables, running processes, installed software, and sometimes credentials. Write access can allow configuration changes or even remote code execution.

Brute-force community strings with `onesixtyone` or `hydra`, then walk the MIB tree with `snmpwalk` or `snmpbulkwalk`. Focus on OIDs that reveal users, processes, network topology, and stored credentials. If SNMPv3 is in use, check for noAuthNoPriv configurations that still lack encryption.

## Phases

- [Enumeration](https://hackindex.io/services/snmp/enumeration.md): Brute force communities, enumerate system info, and walk OIDs (3 guides)
- [Vulnerability Discovery](https://hackindex.io/services/snmp/vulnerability-discovery.md): Test SNMP community strings and write access for RCE paths (2 guides)
- [Exploitation](https://hackindex.io/services/snmp/exploitation.md): Guides on exploiting SNMP write access for RCE via MIB extensions (1 guides)