# SNMP Broad System Enumeration

> Enumerate SNMP MIB trees to extract system info, running processes, network interfaces, and user accounts using SNMPwalk, onesixtyone, and community string brute-forcing.

- **URL:** https://hackindex.io/services/snmp/enumeration/snmp-broad-system-enumeration
- **Path:** SNMP > Enumeration
- **Up:** [Enumeration](https://hackindex.io/services/snmp/enumeration.md)
- **Published:** 2026-01-04
- **Updated:** 2026-08-11

## SNMP Broad System Enumeration

A valid community string turns SNMP into a detailed inventory of the target host. SNMPv1 and SNMPv2c use community strings as the only authentication mechanism. "public" is the default read community on countless devices. If it works, the agent answers queries across thousands of OIDs covering system description, uptime, hostname, interfaces, running processes, installed software, and active TCP connections. This data feeds directly into later attack phases: processes reveal running services and potential privilege escalation targets, interfaces expose internal network segments, and TCP listeners confirm what is actually bound on the host versus what shows up in a port scan.

Nmap's SNMP scripts send safe, structured OID requests. The filter `not (brute or dos)` skips the noisy community string brute-force and denial-of-service scripts, keeping the scan read-only.

## Nmap SNMP Scripts

Broad safe coverage:

- Nmap SNMP Scripts
- snmp-check Wrapper

```bash
nmap -sU -p 161 --script "snmp-* and not (brute or dos)" $TARGET_IP -sV
```

The scripts each target a specific OID subtree. `snmp-info` pulls sysDescr, sysUpTime, and sysName. Uptime matters: a freshly rebooted host may have lost logged sessions or running payloads. `snmp-interfaces` returns ifDescr, ifPhysAddress, and ifInOctets per interface. Multiple interfaces indicate the host is dual-homed, which may expose internal segments not reachable from your current position. `snmp-processes` dumps the full path of each running process. Look for backup agents, antivirus binaries, and remote administration tools. `snmp-netstat` lists active and listening TCP/UDP ports from the host's perspective, not the firewall's. Ports visible here but absent from your Nmap scan indicate firewall rules or services bound to loopback only.

Running all `snmp-*` scripts maximises coverage but adds noise. Use this variant when thoroughness matters more than stealth, or when the target is an internal network device.

Full script set for maximum leakage:

```bash
nmap -sU -p 161 --script snmp-* $TARGET_IP
```

Grep the output for `accounts`, `processes`, `interfaces`, and `listening` to jump directly to the sections that drive your next decision. On Windows hosts, `snmp-processes` often includes the full command line of running services, including paths to executables and configuration files that may point to writable locations.

## snmp-check Wrapper

If you already have a working community string, snmp-check produces a faster, more readable summary than parsing raw Nmap output. It walks the standard MIB subtrees and organises results into labelled sections. Quick summary with known community:

```bash
snmp-check -c public $TARGET_IP
```

The output is divided into labelled sections: system information, network interfaces, network IP, routing, TCP connections, listening UDP ports, network services, processes, and storage units. The processes section is usually the most actionable. Look for database servers, backup clients, endpoint detection agents, and remote access tools. TCP connections show established sessions, which reveal other hosts actively communicating with the target. The installed software list on Windows hosts is pulled from the software MIB and can expose unpatched versions, expired trial software, or VPN clients that suggest remote access paths. Cross-reference the interface list with your scope to identify internal network segments the host is connected to. Any segment outside your current scope is a pivot candidate worth noting before moving on.