312-50 Question 90
Single answer▪ SNMP EnumerationDuring an authorized internal assessment, you discover that a legacy network switch responds on UDP 161. The client wants to know whether SNMP can be used to gather useful reconnaissance data without logging in to the device. You suspect the default read-only community string is still enabled. Which action would be the most appropriate next step to enumerate the device and retrieve details such as hostname, interface information, and routing-related data?
- A
Use snmpwalk with the suspected read-only community string against the target to query standard MIB objects
- B
Use Hydra to brute-force SSH credentials because SNMP does not expose device metadata without authentication
- C
Send a TCP SYN scan to port 161 and then use banner grabbing to identify the switch model and interfaces
- D
Use an SNMP SET request with the public community string to change the device configuration and force it to reveal its hostname
Show answer and explanation
Correct answer: A
Explanation
The best next step is to use an SNMP enumeration tool such as snmpwalk with the suspected read-only community string to query standard MIB data from the device. In real environments, misconfigured SNMPv1/v2c services with default or weak community strings can disclose extensive information useful for reconnaissance, including system name, contact, location, interface details, ARP tables, IP routes, and sometimes installed software or process information depending on the platform. This is why SNMP enumeration is a common CEH topic. From a best-practice perspective, vendors and security guidance consistently recommend disabling SNMP if unused, avoiding default community strings like "public" and "private," restricting access via ACLs, and preferring SNMPv3 for authentication and encryption. Relevant references include Net-SNMP documentation for snmpwalk usage, RFC 1157 for SNMPv1, RFC 1901-1908 for SNMPv2c framework elements, and RFC 3411-3418 for the SNMPv3 architecture and operations.
- A. Correct.
Correct. If UDP 161 is open and the device accepts a valid read-only community string such as the commonly misconfigured default "public," tools like snmpwalk can enumerate Management Information Base (MIB) objects and retrieve valuable information including sysName, interface tables, ARP data, IP addressing, and routing-related details, depending on what the agent exposes. This is a standard and realistic SNMP enumeration technique in CEH-style scenarios.
- B. Incorrect.
Incorrect. Hydra is a credential brute-forcing tool for services such as SSH, FTP, and others, but this does not address the immediate SNMP enumeration opportunity. SNMPv1/v2c commonly uses community strings rather than username/password authentication, and a read-only community string can already provide substantial reconnaissance data without interactive login.
- C. Incorrect.
Incorrect. SNMP typically uses UDP 161, not TCP 161, for normal agent queries. A TCP SYN scan and banner grabbing are not the appropriate methods for enumerating SNMP data such as interface tables or system information. This option reflects a common misconception of treating SNMP like a banner-based TCP service.
- D. Incorrect.
Incorrect. An SNMP SET request is used to modify writable OIDs and requires write access, typically via a read-write community string in SNMPv1/v2c. A read-only community string such as "public" cannot be used to change configuration. Also, forcing configuration changes during enumeration would be inappropriate and risky in an assessment unless explicitly authorized.