Skip to main content
Default Ports: 161/UDP (queries), 162/UDP (traps) SNMP exists to let network devices report status and accept configuration remotely, routers, switches, printers, and plenty of embedded devices all speak it by default. The catch is its authentication model: versions 1 and 2c rely entirely on a “community string,” a shared password sent in plaintext, and a huge number of devices still ship with it left on the default public.

Read-Only Community

Usually named public by default. Lets you query device information, running processes, interfaces, and configuration, often without ever needing a password guess beyond the default.

Read-Write Community

Usually named private by default. Lets you modify device configuration through SNMP SET operations, on some devices this is a direct path to code execution.
SNMPv1 and v2c send everything, including the community string, in plaintext. SNMPv3 adds real authentication and encryption, if you find v3 in use, the tools and techniques below mostly won’t apply the same way.
Always try public and private before brute-forcing anything. Default community strings are still the single most common finding on SNMP services in the wild.

​
Nmap Enumeration

SNMP runs over UDP, so scans need -sU explicitly, it won’t show up in a normal TCP scan at all.
Running every SNMP script at once gives the broadest first look, worth saving straight to a file given how much output it can produce:
Nmap can also brute-force community strings directly, a reasonable first attempt before reaching for a dedicated tool:

​
Enumeration Tools

Once you’ve got a working community string, several tools cover querying OIDs (the identifiers SNMP uses to reference specific pieces of data) with different strengths.
Walks the entire OID tree the community string has access to, the standard first command once you have a working string.
Narrowing to a specific OID branch cuts down the noise once you know what you’re looking for:
When the dedicated tools aren’t available or you want to see live output per attempt, a simple loop against a wordlist works just as well:

​
Useful OIDs

Rather than walking the entire tree every time, these specific branches are usually the ones worth checking first.
The Windows user account OID is worth prioritizing on any Windows target running SNMP, it often returns a full local user list with no authentication needed beyond the community string itself.

​
Write Access and Configuration Changes

Confirming write access and especially pushing a configuration change are active, potentially disruptive actions. Confirm scope explicitly covers this before testing SET operations against a live device.
If a device accepts the default private string (or any guessed write community), snmpset can modify its configuration directly. On some network appliances this extends to actions like changing routing behavior or, on older/embedded devices, even pushing firmware or configuration changes that lead to code execution.
Confirming write access without actually changing anything meaningful is the safer first step, setting a harmless value like the system’s contact info and checking whether it persists:

​
Quick Reference Tools

Hackviser: SNMP

Quick-reference pentesting guide for the SNMP service.

HackTricks: SNMP

Deeper breakdown of SNMP enumeration and exploitation techniques.
Read-write community strings can let you reconfigure production network devices. Treat a confirmed write community as a critical finding and avoid making changes beyond what’s needed to prove access.