Enumerating Snmp Exposure

---
name: enumerating-snmp-exposure
description: >-
  Enumerate network-management exposure through the simple network-management protocol:
  default and guessable community strings, weak or downgradeable versions, read views that
  leak interface tables, routing and neighbor data, running configuration, process and user
  lists and sometimes credentials, and writable objects that let you change device state.
  Covers guessable read and write community strings, version-one and version-two exposure
  where authentication is a shared string sent in the clear, weak version-three auth, and
  over-broad views that disclose or mutate more than management needs. Use when auditing
  network devices, printers, appliances, or hosts that answer management queries. The
  community string or weak credential is the source, the disclosed data or writable object
  is the sink.
license: MIT
---

# Enumerating SNMP exposure: a guessed string that reads or rewrites the device

Network gear, printers, appliances, and many hosts answer a management protocol whose older
versions authenticate with nothing more than a shared string sent in the clear, and whose
default strings are famous. Where that string is guessable and the exposed view is broad, an
unauthenticated peer on the network reads the device's interfaces, routes, neighbor and host
tables, running configuration, and sometimes the credentials inside it - and where a writable
string is exposed, it changes the device's state. You find it by discovering what answers, testing
the strings and versions it accepts, and walking what each grants for both disclosure and write.

## When to use

- You are auditing network devices, printers, appliances, or hosts that expose management queries.
- The environment may run older protocol versions where a shared string is the only authentication.
- Management exposure to disclosure or unauthorized state change is in scope.

## Scope check

Query management services only on devices and networks you own or are authorized to test. Reading a
device's configuration or changing its state without authorization is out of scope. If you can't name
the authorization, stop.

## The loop

1. **Discover what answers and at what version.** Identify the hosts and devices responding to the
   management protocol and which versions they accept. A device that answers the older, shared-string
   versions authenticates with a value sent in the clear; one that accepts only the modern
   authenticated-and-encrypted version is a smaller surface. Map the version each speaks; it sets how
   the rest of the audit proceeds.

2. **Test default and guessable strings.** Try the well-known default read and write strings and common
   variations for each device that speaks a shared-string version. A device answering a default or
   guessable read string is disclosing; one answering a write string is mutable. This is the core
   exposure; enumerate it across every responder, not a sample.

3. **Check for version downgrade and weak modern auth.** Where a device claims the modern version, check
   whether it still answers an older shared-string version, and whether its modern authentication uses a
   weak or shared secret or a null security level. A device that can be spoken to over the weaker version,
   or whose strong version is configured weakly, is exposed at its weakest accepted setting.

4. **Walk the readable view for sensitive disclosure.** For each accessible read string, walk the exposed
   objects and judge what they reveal: interface and address tables, routing and neighbor data that map
   the network, the running configuration, process and account listings, and in some devices stored
   credentials or keys. A view scoped only to benign counters is low risk; one that exposes topology,
   configuration, or secrets is the finding.

5. **Check writable objects.** Where a write string or writable modern context is accessible, determine
   which objects it can change: interface state, routing, configuration, a reboot or a configuration
   push. A writable management surface is a state-change and often a full-control primitive on the device;
   identify what it actually permits without making an unauthorized change outside the test scope.

6. **Confirm and record.** Confirm disclosure by reading data you should not be able to, and confirm a
   writable exposure by an authorized state change in the test scope. Kill the lead if only the modern
   authenticated-and-encrypted version is accepted, no default or guessable string answers, views are
   scoped to non-sensitive objects, and no writable string or context is exposed. Record with the device,
   the string or version, and the data read or object writable.

## Where management exposure leaks

- **A shared string in the clear is not a credential.** The older versions authenticate with a value any
  on-path peer can read or guess; treat any device answering them as unauthenticated.
- **Defaults are public knowledge.** The common read and write strings are famous; a device left on one is
  open to anyone who tries the obvious.
- **The modern version helps only if it is the only one accepted.** A device that also answers an older
  version, or configures the modern one weakly, is exposed at its weakest setting.
- **Disclosure maps the network and leaks secrets.** Interface, routing, and neighbor data hand an attacker
  the topology; configuration and account views hand over more, sometimes credentials.
- **A writable string is device control.** Write access changes state, routing, or configuration - often
  equivalent to owning the device.

## Worked example (a confirm and a kill)

> **Confirm.** A stack of network switches answers the older shared-string version with a default read
> string. Walking the view returns the full interface and routing tables, neighbor data, and the running
> configuration, which includes a management credential. **Confirmed** management disclosure via default
> read string, `high`, remediation = disable the shared-string versions, require the authenticated-and-
> encrypted version with a strong per-device secret, and scope the view to non-sensitive objects.
>
> **Kill.** Every device accepts only the modern authenticated-and-encrypted version with a strong,
> per-device secret and a non-null security level, refuses the older shared-string versions, exposes only
> benign operational counters, and offers no writable string or context. Default-string, downgrade, and
> write attempts all fail. **Killed**, `kill_reason` = "modern authenticated-encrypted only, no shared-string
> version, no guessable secret, read view scoped to non-sensitive objects, no writable exposure."

## Rationalizations to reject

- *"It is read-only access."* → Read-only of the routing table, configuration, and stored credentials is a
  network map and a secret leak. Judge the view, not the verb.
- *"We changed the default string."* → To something guessable, and still over a version that sends it in the
  clear? A weak string on a clear-text version is barely better than the default.
- *"We run the modern version."* → As the only accepted version, or alongside an older one it still answers?
  A downgrade to the shared-string version undoes it.
- *"It is only a printer."* → Printers hold credentials, address books, and network configuration, and often
  answer default strings. The humble device is a classic foothold.
- *"It is on the management network."* → Reachable by whom on that network? A shared string is unauthenticated
  to every peer that can reach the port.

## Executing this in practice

You need the set of devices answering the management protocol and their accepted versions, the strings and
credentials they accept, and a walk of the readable and writable objects each grants - all within an
authorized scope, changing nothing outside it. The audit is behavioral: try the versions and strings, walk what
they expose, and judge disclosure and write against what management actually needs. Reading the intended
configuration tells you the design; querying the device tells you the exposure.

## Related

- `testing-smtp-smuggling-and-email-spoofing` - a sibling network-service audit in the same lane, for mail
  authentication.
- `hunting-non-human-identity-and-secret-reachability` - the credentials a management view discloses are
  machine identities; trace where they then reach.
- `mapping-attack-surface` - inventory the devices and services that answer before enumerating them in depth.
- `auditing-declarative-authorization` - the writable-view exposure is an authorization gap expressed in device
  configuration.
- [FINDING-SCHEMA.md](../../FINDING-SCHEMA.md) - source = the community string or weak credential, sink = the
  disclosed data or writable object, evidence = the data read or the authorized state change.