SNMP <udp 161>

IF SNMP IS OPEN, COMB THROUGH IT THOROUGHLY

snmp-check 192.168.235.156 -c public -v 2c

SNMPwalk

snmpwalk -c public -v1 10.10.11.136 . 
snmpwalk -c public -v2c 10.10.11.136 .
snmpbulkwalk -c public -v2c 10.10.11.136 . 

snmpwalk -c public -v2c 192.168.235.156 NET-SNMP-EXTEND-MIB::nsExtendOutputFull

Credentials may be hiding in this MIB

Sort based on uniqueness

grep -oP '::.*?\.' snmpwalk | sort | uniq -c| sort -n

Running processes

snmpwalk -c public -v1 192.168.229.151 1.3.6.1.2.1.25.4.2.1.2

Search for credentials or other applications running internally

hrSWRun and hrSWInstall can be of interest

Brute force Community Strings

public
private
manager

onesixtyone -c /usr/share/seclists/Discovery/SNMP/common-snmp-community-strings-onesixtyone.txt