SNMP Broad System Enumeration
1 min read
Jan 4, 2026
Valid community strings expose host OS, uptime, interfaces, processes, and TCP listeners. Nmap scripts pull structured data safely.
Nmap SNMP Scripts
Broad safe coverage:
┌──(kali㉿kali)-[~]
└─$ nmap -sU -p 161 --script "snmp-* and not (brute or dos)" $TARGET_IP -sV
snmp-info dumps description, uptime, hostname. snmp-interfaces lists IPs/MACs. snmp-processes shows running paths. snmp-netstat reveals TCP/UDP listeners.
Full script set for maximum leakage:
┌──(kali㉿kali)-[~]
└─$ nmap -sU -p 161 --script snmp-* $TARGET_IP
Filter output for high-value sections.
snmp-check Wrapper
Quick summary with known community:
┌──(kali㉿kali)-[~]
└─$ snmp-check -c public $TARGET_IP
Reports system info, interfaces, processes, software, TCP connections in readable format. Fast alternative to raw walks.
Was this helpful?
Your feedback helps improve this page.