# Pentesting SNMP

## SNMP Ports 161, 162 default

* Commands
* Read, write, trap, traversal command
* SNMP community strings
* Community strings are like a username or password that allows access to the managed device.
* There are three different community strings that allow a user to set 1 ready only commands, 2 read write commands and 3 traps.
* SNMPv3 community string is replaced with a user and password authentication.
* SNMPv1/v2 is factory default read only strings set to public and read write string set to private.

### Onesixtyone

* Onesixtyone is a fast tool to brute force SNMP community strings and take advantage of the connectionless protocol.
* Onesixtyone requires two arguments: a file that contains the list of community strings to try and the target host ip address.
* You can also provide a list of host IP addresses to be scanned by onesixtyone using the -i option.

```
onesixtyone #access help menu
onesixtyone -c snmp_community_strings_wordlist_onesixtyone.txt -p 161 192.168.43.161
```

* Location of wordlists

```
/usr/share/wordlists/seclists/Discovery/SNMP
```

### SNMPwalk

* Snmpwalk queries MIB values to retrieve information about the managed devices, but as a minimum requires a valid SNMP read only community string.
* Run snmpwalk with the default community string ‘public’ on and SNMPv1 device use the following command:

```
snmpwalk -c public -v1 [target host]
```

* You can also request a single object ID value using the following command:

```
snmpwalk -c public -v1 [target host] [OID]
```

* Nmap SNMP scripts

```
ls -l /usr/share/nmap/scripts/snmp*
```
