SNMP:
Enumeration
Brute force communities, enumerate system info, and walk OIDs
SNMP Broad System Enumeration
Enumerate SNMP MIB trees to extract system info, running processes, network interfaces, and user accounts using SNMPwalk, onesixtyone, and community string brute-forcing.
SNMP Community String Brute Forcing
Brute force SNMP community strings using tools like onesixtyone and Hydra to gain unauthorised read/write access to network device configurations.
SNMP enumeration is one of the highest-value recon techniques on internal networks. A valid community string gives you read access to the entire MIB tree: system descriptions, interface tables, ARP caches, routing tables, running processes, installed software, and local user accounts. Tools like snmpwalk, snmpbulkwalk, and onesixtyone automate the extraction.
Community string discovery comes first. Brute-force common strings (public, private, manager, cisco) with onesixtyone or nmap's snmp-brute script. Once you have a valid string, walk the OID tree systematically. Key OIDs like 1.3.6.1.2.1.25.4 (running processes), 1.3.6.1.2.1.25.6 (installed software), and 1.3.6.1.4.1.77.1.2.25 (Windows users) dump information that feeds every later phase.
SNMP v1 and v2c send community strings in cleartext, so packet capture on the wire can reveal strings other hosts are using. The data you extract here often contains credentials, network topology, and software versions that shortcut the rest of the engagement.