SNMP enumeration

Extract information with snmpwalk/onesixtyone. Used in 6 machines, sorted from easiest to hardest. The ▶ link takes you to the minute of the video where it is used.

Hide the ones I have done

Cheatsheets and tools

Nmap and service enumeration

Pandora

easy linux

▶ SNMP enumeration (foothold)

SNMP enumeration
Malicious file upload
Public CVE exploitation
SQL injection
Internal services and port forwarding
PATH hijacking
SUID binaries

AirTouch

medium linux

▶ SNMP enumeration (foothold)

SNMP enumeration
Wi-Fi attacks
Authentication bypass
Malicious file upload
Hash cracking
Traffic analysis (pcap)
Sudo abuse
Credentials in files

Carrier

medium linux

▶ SNMP enumeration (foothold)

SNMP enumeration
Command injection
Traffic analysis (pcap)

Mentor

medium linux

▶ SNMP enumeration (foothold)

API enumeration
SNMP enumeration
Vhost and subdomain fuzzing
Command injection
Container escape
Internal services and port forwarding
Hash cracking
Credentials in files

Sneaky

medium linux

▶ SNMP enumeration (foothold)

SNMP enumeration
SQL injection
SSH keys
SUID binaries
Stack buffer overflow

Conceal

hard windows

▶ SNMP enumeration (foothold)

SNMP enumeration
IIS and ASP.NET
Malicious file upload
Hash cracking
SeImpersonate / Potatoes
Windows exploits

Often goes with

Hash cracking
Malicious file upload
Command injection
Credentials in files
Internal services and port forwarding
SQL injection
SUID binaries
Traffic analysis (pcap)

Combine this technique with others in the search →