> For the complete documentation index, see [llms.txt](https://oscp.adot8.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://oscp.adot8.com/services/snmp-less-than-udp-161-greater-than.md).

# SNMP \<udp 161>

{% hint style="danger" %}
IF SNMP IS OPEN, COMB THROUGH IT THOROUGHLY
{% endhint %}

```
snmp-check 192.168.235.156 -c public -v 2c
```

### SNMPwalk

<pre><code><strong>snmpwalk -c public -v1 10.10.11.136 . 
</strong>snmpwalk -c public -v2c 10.10.11.136 .
snmpbulkwalk -c public -v2c 10.10.11.136 . 
</code></pre>

{% hint style="warning" %}
`snmpwalk -c public -v2c 192.168.235.156 NET-SNMP-EXTEND-MIB::nsExtendOutputFull`

Credentials may be hiding in this MIB
{% endhint %}

Sort based on uniqueness

```
grep -oP '::.*?\.' snmpwalk | sort | uniq -c| sort -n
```

Running processes

```
snmpwalk -c public -v1 192.168.229.151 1.3.6.1.2.1.25.4.2.1.2
```

Search for credentials or other applications running internally

{% hint style="info" %}
hrSWRun and hrSWInstall can be of interest
{% endhint %}

### Brute force Community Strings

```
public
private
manager
```

```
onesixtyone -c /usr/share/seclists/Discovery/SNMP/common-snmp-community-strings-onesixtyone.txt
```