Monitoring

Monitoring and observability infrastructure is a disproportionately valuable target. To do its job it must reach into every system it watches, so it holds credentials for the estate (SNMP strings, device logins, database and cloud secrets), maps the internal network, and often runs commands on monitored hosts by design. Compromising a monitoring platform therefore yields reconnaissance, stored credentials, and frequently code execution across many systems at once. The area divides into two layers: the telemetry protocols that agents and collectors speak, and the platforms that collect, store, and visualize that telemetry.

# find monitoring surfaces on a host or network
nmap -sU -p161,162 <target>                    # SNMP agent / traps
nmap -p443,80,3000,9090,10050,10051,5666,8086 -sV <target>  # web UIs, Zabbix, NRPE, etc.

Subtopics#

• Protocols: SNMP, syslog, and NetFlow/IPFIX.
• Platforms: Zabbix, Nagios/Icinga, PRTG, Cacti, LibreNMS, Grafana, Prometheus, SolarWinds.

References#

• HackTricks: network services pentesting
• MITRE ATT&CK: network sniffing and valid accounts