Penetration Testing with Kali Linux OffSec

snmpwalk -c public -v1 192.168.50.151 1.3.6.1.2.1.25.6.3.1.2
iso.3.6.1.2.1.25.6.3.1.2.1 = STRING: "Microsoft Visual C++ 2019 X64 Minimum Runtime - 
14.27.29016" 
iso.3.6.1.2.1.25.6.3.1.2.2 = STRING: "VMware Tools" 
iso.3.6.1.2.1.25.6.3.1.2.3 = STRING: "Microsoft Visual C++ 2019 X64 Additional Runtime 
- 14.27.29016" 
iso.3.6.1.2.1.25.6.3.1.2.4 = STRING: "Microsoft Visual C++ 2015-2019 Redistributable 
(x86) - 14.27.290" 
iso.3.6.1.2.1.25.6.3.1.2.5 = STRING: "Microsoft Visual C++ 2015-2019 Redistributable 
(x64) - 14.27.290" 
iso.3.6.1.2.1.25.6.3.1.2.6 = STRING: "Microsoft Visual C++ 2019 X86 Additional Runtime 
- 14.27.29016" 
iso.3.6.1.2.1.25.6.3.1.2.7 = STRING: "Microsoft Visual C++ 2019 X86 Minimum Runtime - 
14.27.29016" 
... 
Listing 89 - Using snmpwalk to enumerate installed software 
When combined with the running process list we obtained earlier, this information can become 
extremely valuable for cross-checking the exact software version a process is running on the 
target host. 
Another SNMP enumeration technique is to list all the current TCP listening ports: 
kali@kali:~$ 
snmpwalk -c public -v1 192.168.50.151 1.3.6.1.2.1.6.13.1.3
iso.3.6.1.2.1.6.13.1.3.0.0.0.0.88.0.0.0.0.0 = INTEGER: 88 
iso.3.6.1.2.1.6.13.1.3.0.0.0.0.135.0.0.0.0.0 = INTEGER: 135 
iso.3.6.1.2.1.6.13.1.3.0.0.0.0.389.0.0.0.0.0 = INTEGER: 389 
iso.3.6.1.2.1.6.13.1.3.0.0.0.0.445.0.0.0.0.0 = INTEGER: 445 
iso.3.6.1.2.1.6.13.1.3.0.0.0.0.464.0.0.0.0.0 = INTEGER: 464 
iso.3.6.1.2.1.6.13.1.3.0.0.0.0.593.0.0.0.0.0 = INTEGER: 593 
iso.3.6.1.2.1.6.13.1.3.0.0.0.0.636.0.0.0.0.0 = INTEGER: 636 
iso.3.6.1.2.1.6.13.1.3.0.0.0.0.3268.0.0.0.0.0 = INTEGER: 3268 
iso.3.6.1.2.1.6.13.1.3.0.0.0.0.3269.0.0.0.0.0 = INTEGER: 3269 
iso.3.6.1.2.1.6.13.1.3.0.0.0.0.5357.0.0.0.0.0 = INTEGER: 5357 
iso.3.6.1.2.1.6.13.1.3.0.0.0.0.5985.0.0.0.0.0 = INTEGER: 5985 
... 
Listing 90 - Using snmpwalk to enumerate open TCP ports 
The integer value from the output above represents the current listening TCP ports on the target. 
This information can be extremely useful as it can disclose ports that are listening only locally and 
thus reveal a new service that had been previously unknown. 
6.4
Wrapping Up 
In this Module, we explored the foundational aspects of the iterative process of both passive and 
active information gathering. We first covered a variety of techniques and tools to locate 
information about companies and their employees. This information can often prove to be 

---

Penetration Testing with Kali Linux
PWK - Copyright © 2023 OffSec Services Limited. All rights reserved. 
162 
invaluable in later stages of the engagement. We then focused on how to actively scan and 
enumerate services that are commonly exposed. We learned how to perform these enumeration 
steps from both Kali Linux and a Windows client. 
There is never one “best” tool for any given situation, especially since many tools in Kali Linux 
overlap in function. It’s always best to familiarize ourselves with as many tools as possible, learn 
their nuances, and whenever possible, measure the results to understand what’s happening 
behind the scenes. In some cases, the “best” tool is the one held by the pentester who is most 
familiar with. 

---

Penetration Testing with Kali Linux
PWK - Copyright © 2023 OffSec Services Limited. All rights reserved. 
163 
7
Vulnerability Scanning 
In this Learning Module, we will cover the following Learning Units: 
•
Vulnerability Scanning Theory 
•
Vulnerability Scanning with Nessus 
•
Vulnerability Scanning with Nmap 
The discovery of vulnerabilities is an integral part of any security assessment. The process of 
identifying the attack surface of a piece of software, system, or network is called