Home > Network Pentesting

SNMP Enumeration

SNMP enumeration collects detailed information from devices that use the Simple Network Management Protocol. SNMP is commonly enabled on servers, routers, switches, printers, firewalls, and IoT systems. When misconfigured, it leaks sensitive information such as network interfaces, routing tables, system names, running processes, installed software, and user accounts. SNMP enumeration is one of the most powerful techniques for mapping internal infrastructure.

Understanding SNMP

SNMP operates mainly on UDP port 161. It uses “community strings” as a form of access control.
Common strings include:

  • public (read-only, often misconfigured)

  • private (read-write)

If a device exposes SNMP with default strings, pentesters can extract large amounts of system data.

SNMP versions include:

  • SNMPv1: Unencrypted, weak, easily abused

  • SNMPv2c: Same weaknesses, but more features

  • SNMPv3: Secure (authentication + encryption)

Enumeration focuses on v1 and v2c because they are commonly misconfigured.

Checking SNMP Availability

Before deep enumeration, pentesters verify whether SNMP responds.

Basic Probe

snmpwalk -v2c -c public 10.10.10.5

If the device responds, SNMP is enabled and accessible.

Checking Supported Versions

nmap -sU -p161 --script snmp-info 10.10.10.5

This reveals version, device type, OS, and uptime.

Enumerating System Information

SNMP reveals general system details through standard OIDs.

System Information Enumeration

snmpwalk -v2c -c public 10.10.10.5 1.3.6.1.2.1.1

This reveals:

  • Hostname

  • OS description

  • Device type

  • Uptime

  • Contact information

  • System location

These values help identify the device and its role.

Enumerating Network Interfaces

SNMP exposes detailed network interface information.

Interface Enumeration

snmpwalk -v2c -c public 10.10.10.5 1.3.6.1.2.1.2

This reveals:

  • Interface names

  • MAC addresses

  • IP addresses

  • Link status

  • Speed

  • VLAN assignments

Pentesters use this to map internal connections and identify hidden networks.

Enumerating Routing Tables

Routing information helps map segmentation and pivot paths.

Routing Table Enumeration

snmpwalk -v2c -c public 10.10.10.5 1.3.6.1.2.1.4.21

This reveals:

  • Known networks

  • Next hops

  • Route metrics

This information exposes network architecture.

Enumerating ARP Tables

ARP tables reveal neighboring hosts.

snmpwalk -v2c -c public 10.10.10.5 1.3.6.1.2.1.4.22

ARP enumeration identifies internal hosts that scanners might miss.

Enumerating Running Processes

SNMP exposes active processes on some devices.

snmpwalk -v2c -c public 10.10.10.5 1.3.6.1.2.1.25.4

This reveals:

  • Process names

  • Process IDs

  • Running software

Process data helps detect outdated programs or exploitable services.

Enumerating Installed Software

snmpwalk -v2c -c public 10.10.10.5 1.3.6.1.2.1.25.6

Installed software enumeration helps identify vulnerable or unpatched applications.

Enumerating Users

Some SNMP-enabled systems expose user lists.

snmpwalk -v2c -c public 10.10.10.5 1.3.6.1.4.1

OID values under enterprise trees often reveal custom system information including users.

Enumerating Device-Specific Information

Different manufacturers expose unique fields, including:

  • Cisco: interface configs, ACLs, routing

  • HP: printer queues, jobs, pages

  • Linux hosts: running daemons, file systems

  • Windows hosts: services, storage devices

Pentesters identify the vendor using SNMP sysDescr values.

Nmap SNMP Scripts

Nmap provides automated SNMP enumeration.

Enumerate Users

nmap --script snmp-usr -p161 10.10.10.5

Enumerate Processes

nmap --script snmp-processes -p161 10.10.10.5

Enumerate Interfaces

nmap --script snmp-iface -p161 10.10.10.5

Enumerate All Common SNMP Data

nmap --script snmp* -p161 10.10.10.5

This collects detailed information in a single scan.

Identifying SNMP Misconfigurations

Pentesters look for:

  • Default “public" string

  • Default “private” string

  • SNMPv1/v2c enabled

  • Weak ACLs

  • Exposed routing tables

  • Exposed user lists

  • Lack of network segmentation

  • Devices leaking internal IPs

These issues often lead to lateral movement or full network mapping.

Why SNMP Enumeration Matters

SNMP enumeration provides some of the deepest internal visibility available during a pentest. It exposes hosts, interfaces, routes, processes, users, and software. When SNMP is misconfigured, it becomes a powerful pivoting tool and reveals sensitive infrastructure details without authentication.

Intel Dump

  • SNMP uses UDP port 161 and commonly exposes sensitive data

  • Default community strings “public” and “private” are major risks

  • snmpwalk and Nmap scripts reveal system, network, routing, process, and user data

  • SNMP often exposes internal architecture, making it valuable for pivoting and lateral movement

HOME LEARN COMMUNITY DASHBOARD