SNMP Community String Brute Forcing
1 min read
Jul 10, 2026
SNMPv1/v2c relies on community strings for access. Defaults like public/private often remain; success unlocks full MIB walks.
onesixtyone Fast Brute
Quick dictionary attack:
┌──(kali㉿kali)-[~]
└─$ onesixtyone -c /usr/share/seclists/Discovery/SNMP/snmp.txt $TARGET_IP
Output shows responding communities with version. Valid hits enable immediate walks.
Single common test:
┌──(kali㉿kali)-[~]
└─$ onesixtyone -c public,private,manager $TARGET_IP
Fastest for initial checks.
Nmap snmp-brute Script
Integrated brute:
┌──(kali㉿kali)-[~]
└─$ nmap -sU -p 161 --script snmp-brute --script-args snmp-brute.communitiesdb=/usr/share/seclists/Discovery/SNMP/snmp.txt $TARGET_IP
Lists valid communities and attempts basic info pull. Slower but chains with other scripts.
After finding a valid community string, confirm the vulnerability: SNMP Default and Weak Community Strings covers version and access assessment. If the string has write access, see SNMP Write-Enabled Community String.
References
-
snmp-brute NSE scriptnmap.org/nsedoc/scripts/snmp-brute.html (opens in new tab)
Community string brute forcing
Was this helpful?
Your feedback helps improve this page.