Lab 4-02: Perform SNMP Enumeration Using SnmpWalk – Full Notes

1. Introduction

SNMP Enumeration is the process of gathering detailed information from network devices such as routers, switches, and hubs using the Simple Network Management Protocol (SNMP). Many devices expose valuable information if SNMP is misconfigured or uses default community strings, which can be exploited by attackers.

In this lab, the scenario involves:

• Company: TechCore Systems, a technology solutions provider.
• Security Provider: SecureNet Assessments.
• Objective: Identify misconfigured SNMP settings to prevent leakage of sensitive network information.

2. What is SNMP?

SNMP (Simple Network Management Protocol) is a protocol used to monitor and manage network devices. Devices that commonly use SNMP include:

• Routers
• Switches
• Firewalls
• Hubs

SNMP allows administrators to:

• Check device status
• Read configurations
• Gather statistics such as bandwidth usage, device uptime, and connected devices

SNMP uses the following ports:

• UDP 161 – SNMP agent port (used to query devices)
• UDP 162 – SNMP trap port (used by devices to send notifications)

3. Goals of SNMP Enumeration

The main goals of SNMP Enumeration are:

• Identify active devices using SNMP
• Retrieve system information such as OS type, device name, and uptime
• Discover network topology, interfaces, and routing tables
• Check for weak or default SNMP community strings

4. Information Gathered and Its Importance

4.1 Device Information

Description: SNMP can reveal the hostname, device type, and operating system.

Importance:

• Helps map the network and identify critical devices
• Assists attackers in selecting high-value targets

4.2 Network Interfaces and IPs

Description: SNMP provides information about active interfaces, IP addresses, and MAC addresses.

Importance:

• Helps attackers map the network topology
• Useful for planning targeted attacks or lateral movement

4.3 Routing Tables

Description: SNMP can reveal routing tables of network devices.

Importance:

• Shows paths between network segments
• Reveals internal network design

4.4 Uptime and Performance Data

Description: SNMP can show how long a device has been running and its performance statistics.

Importance:

• Helps identify devices for maintenance or exploitation

4.5 Community Strings

Description: Community strings are like passwords for SNMP:

• public – read-only access (default)
• private – read-write access (default)

Importance:

• Default strings expose critical configuration data
• Weak strings allow attackers to modify device settings

5. Tools and Commands

5.1 SnmpWalk

SnmpWalk is a command-line tool used to query SNMP-enabled devices and walk through the Management Information Base (MIB).

snmpwalk -v 1 -c public <target-ip>
snmpwalk -v 2c -c public <target-ip>
snmpwalk -v 3 -l authNoPriv -u username -A password <target-ip>

Explanation:

• -v 1 – SNMP version 1
• -v 2c – SNMP version 2c
• -v 3 – SNMP version 3 (more secure)
• -c public – Community string for read-only access
• -l authNoPriv – Authentication without encryption

5.2 Example Commands and Output

# Scan a target device with SNMPv2c
snmpwalk -v 2c -c public 192.168.1.1

# Sample output snippet
SNMPv2-MIB::sysDescr.0 = STRING: Cisco IOS Software, C880 Software (C880DATA-UNIVERSALK9-M), Version 15.2(4)M6
SNMPv2-MIB::sysUpTime.0 = Timeticks: (123456789) 14 days, 6:56:07.89
SNMPv2-MIB::ifDescr.1 = STRING: FastEthernet0/0
SNMPv2-MIB::ifDescr.2 = STRING: FastEthernet0/1

6. Importance of SNMP Enumeration in Cybersecurity

• Identifies misconfigured devices and default credentials
• Helps map network topology and discover critical devices
• Essential step for penetration testers to plan attacks safely
• Helps administrators secure SNMP settings and prevent information leakage

7. Best Practices for SNMP Security

• Change default community strings (never use "public" or "private")
• Use SNMPv3 for encrypted and authenticated queries
• Restrict SNMP access to trusted management hosts
• Regularly audit SNMP-enabled devices for sensitive information exposure

8. Conclusion

SNMP Enumeration using SnmpWalk is a powerful technique to collect detailed information from network devices. If SNMP is misconfigured, it can reveal hostnames, interfaces, routing tables, uptime, and more. Understanding this lab is critical for both penetration testers and network administrators to identify vulnerabilities, secure network devices, and prevent attackers from gaining valuable intelligence.