Skip to content
HackIndex.io

SNMP Broad System Enumeration

3 min read Created Jan 4, 2026 Last updated Aug 11, 2026

SNMP Broad System Enumeration

A valid community string turns SNMP into a detailed inventory of the target host. SNMPv1 and SNMPv2c use community strings as the only authentication mechanism. "public" is the default read community on countless devices. If it works, the agent answers queries across thousands of OIDs covering system description, uptime, hostname, interfaces, running processes, installed software, and active TCP connections. This data feeds directly into later attack phases: processes reveal running services and potential privilege escalation targets, interfaces expose internal network segments, and TCP listeners confirm what is actually bound on the host versus what shows up in a port scan.

Nmap's SNMP scripts send safe, structured OID requests. The filter not (brute or dos) skips the noisy community string brute-force and denial-of-service scripts, keeping the scan read-only.

Nmap SNMP Scripts

Broad safe coverage:

  • Nmap SNMP Scripts
  • snmp-check Wrapper
┌──(kali㉿kali)-[~]
└─$ nmap -sU -p 161 --script "snmp-* and not (brute or dos)" $TARGET_IP -sV

The scripts each target a specific OID subtree. snmp-info pulls sysDescr, sysUpTime, and sysName. Uptime matters: a freshly rebooted host may have lost logged sessions or running payloads. snmp-interfaces returns ifDescr, ifPhysAddress, and ifInOctets per interface. Multiple interfaces indicate the host is dual-homed, which may expose internal segments not reachable from your current position. snmp-processes dumps the full path of each running process. Look for backup agents, antivirus binaries, and remote administration tools. snmp-netstat lists active and listening TCP/UDP ports from the host's perspective, not the firewall's. Ports visible here but absent from your Nmap scan indicate firewall rules or services bound to loopback only.

Running all snmp-* scripts maximises coverage but adds noise. Use this variant when thoroughness matters more than stealth, or when the target is an internal network device.

Full script set for maximum leakage:

┌──(kali㉿kali)-[~]
└─$ nmap -sU -p 161 --script snmp-* $TARGET_IP

Grep the output for accounts, processes, interfaces, and listening to jump directly to the sections that drive your next decision. On Windows hosts, snmp-processes often includes the full command line of running services, including paths to executables and configuration files that may point to writable locations.

snmp-check Wrapper

If you already have a working community string, snmp-check produces a faster, more readable summary than parsing raw Nmap output. It walks the standard MIB subtrees and organises results into labelled sections. Quick summary with known community:

┌──(kali㉿kali)-[~]
└─$ snmp-check -c public $TARGET_IP

The output is divided into labelled sections: system information, network interfaces, network IP, routing, TCP connections, listening UDP ports, network services, processes, and storage units. The processes section is usually the most actionable. Look for database servers, backup clients, endpoint detection agents, and remote access tools. TCP connections show established sessions, which reveal other hosts actively communicating with the target. The installed software list on Windows hosts is pulled from the software MIB and can expose unpatched versions, expired trial software, or VPN clients that suggest remote access paths. Cross-reference the interface list with your scope to identify internal network segments the host is connected to. Any segment outside your current scope is a pivot candidate worth noting before moving on.