An algorithm for discovering SNMP protocol vulnerabilities is proposed, which solves several problems including single and one-dimensional strategies of constructing test cases, lack of the exception monitor and debugger or inapplicability of the network and SNMP-related software. First, by analyzing the SNMP RFC specification, the algorithm adopts the generation strategy for constructing test cases. Second, the mutation strategy is adopted to construct test cases on the basis of known information about SNMP vulnerabilities and the previous malformed data. According to the algorithm, a tool named tje SRPFuzzer is developed for bug hunting. Finally, an experiment is done on routers and software, including the Cisco router, wireshark and so on. Four groups of vulnerabilities are found, which verifies the SRPFuzzer's validity. Meanwhile, comparing with the PROTOS and other 3 tools, the SRPFuzzer is superior to these tools at test case construction, monitoring, debugging, bug hunting ability and so on.