> For the complete documentation index, see [llms.txt](https://staphysec.gitbook.io/staphysec/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://staphysec.gitbook.io/staphysec/pentesting/161-162-10161-10162-udp-pentesting-snmp.md).

# 161,162,10161,10162/udp - Pentesting SNMP

Resources : 

* [Hacktricks](https://book.hacktricks.xyz/pentesting/pentesting-snmp).
* [auvik ](https://www.auvik.com/franklyit/blog/network-basics-what-is-snmp/)quickly explained.

Simple Network Management Protocol \[SNMP]

All the settings that can be made for the SNMP daemon are defined and described in the [manpage](http://www.net-snmp.org/docs/man/snmpd.conf.html).

### Default conf

```
cat /etc/snmp/snmpd.conf | grep -v "#" | sed -r '/^\s*$/d'
# Dangerous settings
rwuser noauth	# Provides access to the full OID tree without authentication.
rwcommunity <community string> <IPv4 address>	#Provides access to the full OID tree regardless of where the requests were sent from.
rwcommunity6 <community string> <IPv6 address>	#Same access as with rwcommunity with the difference of using IPv6.

```

### Footprinting

For footprinting SNMP, we can use tools like `snmpwalk`, `onesixtyone`, and `braa`. `Snmpwalk` is used to query the OIDs with their information. `Onesixtyone` can be used to brute-force the names of the community strings since they can be named arbitrarily by the administrator.

**SNMPwalk**

```
snmpwalk -v2c -c public 10.129.14.128 . # dot  to crawl all
```

we can use `onesixtyone` and `SecLists` wordlists to identify community strings.

```
onesixtyone -c /opt/useful/SecLists/Discovery/SNMP/snmp.txt <IP>
```

Once we know a community string, we can use it with [braa](https://github.com/mteg/braa) to brute-force the individual OIDs and enumerate the information behind them.

```
braa <community string>@<IP>:.1.3.6.*   # Syntax
```