📡 SNMP — UDP Port 161

Network management protocol. Flow: enumerate community strings → try versions 1 / 2c / 3 → try different OIDs.

nmap IP -p 161 -sU --open -oG snmp.txt
snmpwalk -c public -v1 -t 10 192.168.50.151 -Oa        # -c community, -v version, -t timeout
snmpwalk -v 1 -c public 192.168.189.149 NET-SNMP-EXTEND-MIB::nsExtendObjects
snmpwalk -v 1 -c public 192.168.189.149 1.3.6.1.2.1.4.34.1.3
snmpwalk -v 1 -c public 192.168.189.149 .1
python3 snmpbrute.py -t mentorquotes.htb               # brute community strings

snmpbulkwalk is faster. Refer to Windows SNMP MIB values for juicy OIDs (processes, users, software, listening ports).

SNMPBrute.py