E-ONE
onesixtyone
Fast SNMP scanner that brute-forces community strings across many hosts in parallel.
OVERVIEW
onesixtyone (trailofbits/onesixtyone) is a fast SNMP scanner purpose-built for one job: fire a wordlist of candidate community strings at a list of hosts and report which combination gets a response. It sends requests asynchronously rather than waiting for a timeout on each one, which lets it sweep a whole subnet for exposed SNMP agents in a fraction of the time a naive per-host snmpwalk loop would take.
It deliberately does not enumerate MIB data itself — that is snmpwalk's or snmp-check's job — so the normal workflow is running onesixtyone first to shortlist responsive host/string pairs, then handing that shortlist to a deeper enumeration tool.
USE CASES
Practical use cases
- 01
Sweeping a whole subnet or IP range to find every host that answers to a known community string.
- 02
Brute-forcing a wordlist of common or client-provided community strings against a single host.
- 03
Prioritizing which hosts deserve a full snmpwalk instead of walking every host on the range one by one.
- 04
Quickly re-checking a subnet after a remediation to confirm SNMP community strings were actually rotated.
QUICK START
Across a range with SNMP potentially exposed, to quickly find which hosts respond to a wordlist of community strings before enumerating each one manually.
- Confirm SNMP (UDP 161) sweeping across this range is in scope.
- Build or reuse a community-string wordlist (the bundled dict.txt is a reasonable start).
- Run onesixtyone against the target range or host list with that wordlist.
- Take every responsive host/string pair and hand it to snmpwalk for the actual MIB enumeration.
onesixtyone -c dict.txt -i hosts.txtBEFORE YOU RUN IT
What to check before running it
Its speed comes from sending requests without waiting for each timeout, which can look like a burst scan to a monitored network — throttle it on sensitive segments.
A responsive community string only confirms brute-force succeeded; treat the actual data exposure (from a follow-up snmpwalk) as the real finding, not the hit itself.
Like any SNMPv1/v2c tool, it sends community strings in plaintext, so results can be visible to anyone sniffing the same segment.