Onesixtyone

Onesixtyone is an SNMP analysis tool that is named for the UDP port upon which SNMP operates. It is a very simple SNMP scanner that only requests the system description value for any specified IP address(es).

Getting ready

To use Onesixtyone to perform SNMP analysis, you will need devices that have SNMP enabled and can be probed and inspected. In the examples provided, an installation of Windows XP is used to perform this task. For more information on setting up a Windows system, please refer to the Installing Windows Server recipe in Chapter 1. Getting Started.

How to do it…

This information can be used to accurately fingerprint the operating system of a target device. To use Onesixtyone, one can pass the target IP address and the community string as arguments:

root@KaliLinux:~# onesixtyone 172.16.36.134 public
Scanning 1 hosts, 1 communities
172.16.36.134 [public] Hardware: x86 Family 6 Model 58 Stepping 9 AT/AT COMPATIBLE - Software: Windows 2000 Version 5.1 (Build 2600 Uniprocessor Free)
Copy

In the example provided, the community string public is used to query the device at 172.16.36.134 for its system description. This is one of the most common default community strings used by various network devices. As indicated by the output, the remote host replied to the query with a description string that identifies itself.

How it works…

SNMP is a protocol that can be used to manage networked devices and facilitate the sharing of information across those devices. The usage of this protocol is often necessary in enterprise network environments; however, system administrators frequently fail to modify the default community strings that are used to share information across SNMP devices. In situations where this is the case, information can be gathered about network devices by appropriately guessing the default community strings used by those devices.

onesixtyone