Lion Cipher Lab

Enumerate SNMP with onesixtyone and snmpwalk

• Penetration Testing / Red Team
• Intermediate
• ~40 min
• Free · no account required

Why it matters

SNMP — the Simple Network Management Protocol — runs quietly on an enormous share of the devices that hold a network together: routers, switches, printers, firewalls, hypervisors, UPS units, servers, cameras. It exists so that a monitoring system can ask a device 'how are you?' and read back a structured answer. The catch is how the two oldest and still most common versions, SNMPv1 and SNMPv2c, decide who is allowed to ask: a COMMUNITY STRING, which is nothing more than a shared password sent in clear text, and which ships from the factory set to the word 'public' on a staggering number of…

What you'll learn

• defining SNMP, community strings, OIDs and MIBs in plain language, and explaining why an SNMP service is one of the highest-yield finds in network recon
• standing up snmpd on your own lab machine with the default read-only community 'public' (SNMPv1/v2c) so you have a legitimate target to attack
• spraying a wordlist of community strings with `onesixtyone` and reading which one the service accepts
• walking the whole MIB tree with `snmpwalk -v2c -c public` and pulling targeted OIDs — sysDescr, hostname, running processes, installed software, interfaces and listening ports
• reproducing the same enumeration with Nmap's snmp-info and snmp-processes NSE scripts
• migrating the service to SNMPv3 authPriv (a named user with authentication AND encryption), deleting the community, and restricting the listener to a source
• measuring before/after: v2c public dumps everything; the identical unauthenticated snmpwalk against the v3 host returns nothing
• judgment: why default communities persist for decades, why a well-run network makes this spray come up empty, and what that empty result actually proves

Steps in this lab

1. What SNMP actually is, and why an open one is a recon goldmine
2. Rules of engagement: this is your box, on your wire, offline
3. Build the target: snmpd with community 'public' (the weakness, on purpose)
4. Spray community strings with onesixtyone
5. Walk the whole tree with snmpwalk -v2c -c public
6. Pull the intel by name: processes, software, interfaces, ports
7. Cross-check with Nmap's SNMP NSE scripts
8. THE FIX: SNMPv3 authPriv, community removed, source restricted
9. Measure it: the same spray and walk, now returning nothing
10. Judgment: why 'public' persists, and what an empty spray really means

Open the full interactive lab →