Service

Hosts

Hosts covers attacking network systems from recon and port scanning to exploitation, post-exploitation, privilege escalation, lateral movement, persistence, and data exfiltration via ICMP

9 guides 4 phases

1 min read Created: Dec 28, 2025 Updated: Jul 14, 2026

Host discovery and enumeration is the foundation of every network penetration test. Rather than targeting a single protocol, this phase identifies live systems, their operating systems, and running services across a target network. Tools like Nmap, Masscan, and Netdiscover map the attack surface before service-specific testing begins.

Thorough host enumeration prevents blind spots. Missed hosts mean missed vulnerabilities. Attackers and testers alike start by determining which IP addresses are alive, what ports are open, and what services respond. ARP scanning works on local segments, ICMP and TCP probes reach across routed networks, and DNS enumeration reveals hostnames and naming conventions that hint at function and importance.

Standard techniques include ARP scans (arp-scan -l), ICMP sweeps (nmap -sn), TCP SYN scans (nmap -sS), and full port scans to catch services on non-standard ports. OS detection (nmap -O) and service version detection (nmap -sV) add context. Combining results from multiple scanning methods ensures complete coverage, since firewalls and filtering may hide hosts from any single technique.