Question

During an internal assessment, a penetration tester wants to enumerate network management services that are commonly overlooked by TCP-only scans. The tester suspects several devices are running SNMP with default community strings. Which Nmap command best supports discovering and enumerating these SNMP services?

Accepted Answer

nmap -sU -p 161 --script snmp-brute,snmp-info 10.0.0.0/24

Answer

nmap -sS -p 161 --script snmp-info 10.0.0.0/24

Answer

nmap -sT -p 162 --script banner 10.0.0.0/24

Answer

nmap -sU -p 53 --script dns-recursion 10.0.0.0/24