Skip to content
HackIndex.io

SNMP:

Enumeration

Brute force communities, enumerate system info, and walk OIDs

3 guides • Created Dec 28, 2025 • Updated Mar 29, 2026
3 guides

SNMP Broad System Enumeration

Enumerate SNMP MIB trees to extract system info, running processes, network interfaces, and user accounts using SNMPwalk, onesixtyone, and community string brute-forcing.

Jan 4, 2026 • 3 min read
SNMP Community String Brute Forcing

SNMP Community String Brute Forcing

Brute force SNMP community strings using tools like onesixtyone and Hydra to gain unauthorised read/write access to network device configurations.

Jan 4, 2026 • 5 min read

SNMP enumeration is one of the highest-value recon techniques on internal networks. A valid community string gives you read access to the entire MIB tree: system descriptions, interface tables, ARP caches, routing tables, running processes, installed software, and local user accounts. Tools like snmpwalk, snmpbulkwalk, and onesixtyone automate the extraction.

Community string discovery comes first. Brute-force common strings (public, private, manager, cisco) with onesixtyone or nmap's snmp-brute script. Once you have a valid string, walk the OID tree systematically. Key OIDs like 1.3.6.1.2.1.25.4 (running processes), 1.3.6.1.2.1.25.6 (installed software), and 1.3.6.1.4.1.77.1.2.25 (Windows users) dump information that feeds every later phase.

SNMP v1 and v2c send community strings in cleartext, so packet capture on the wire can reveal strings other hosts are using. The data you extract here often contains credentials, network topology, and software versions that shortcut the rest of the engagement.