onesixtyone
A handy tool for enumerating snmp
Scan snmp for a variety of community names
This command tries an SNMP community list from Metasploit against a host called 1.2.3.4, with output saved to mylog.log and debugging turned on:
onesixtyone -c /opt/tools/metasploit-framework/data/wordlists/snmp_default_pass.txt 1.2.3.4 -o mylog.log -d If, for example, you've got a bunch of subnets in a subnets.txt file but need to build a list of every IP so that you can feed it to onesixtyone, this blurb will set your attacking IP (so it's excluded) but build a list of all ranges in the 10.0.0.0/24, 172.16.31.0/24 and 192.168.1.0/24 networks:
ATTACKER_IP="10.0.0.50"
nmap -n -sL -iL subnets.txt |
awk '/Nmap scan report/{print $NF}' |
grep -vF "$ATTACKER_IP" > targets.txtThen you can do a HUGE sweep of SNMP across all the subnets and log them to a .log file:
onesixtyone -c strings.txt -i targets.txt -w 100 -o snmp_sweep.log