# Hosts

> Hosts covers attacking network systems from recon and port scanning to exploitation, post-exploitation, privilege escalation, lateral movement, persistence, and data exfiltration via ICMP

- **URL:** https://hackindex.io/services/hosts
- **Type:** Service
- **Tags:** network, enumeration, reconnaissance, port-scanning, hosts, infrastructure
- **Published:** 2025-12-28
- **Updated:** 2026-07-14

Host discovery and enumeration is the foundation of every network penetration test. Rather than targeting a single protocol, this phase identifies live systems, their operating systems, and running services across a target network. Tools like Nmap, Masscan, and Netdiscover map the attack surface before service-specific testing begins.

Thorough host enumeration prevents blind spots. Missed hosts mean missed vulnerabilities. Attackers and testers alike start by determining which IP addresses are alive, what ports are open, and what services respond. ARP scanning works on local segments, ICMP and TCP probes reach across routed networks, and DNS enumeration reveals hostnames and naming conventions that hint at function and importance.

Standard techniques include ARP scans (`arp-scan -l`), ICMP sweeps (`nmap -sn`), TCP SYN scans (`nmap -sS`), and full port scans to catch services on non-standard ports. OS detection (`nmap -O`) and service version detection (`nmap -sV`) add context. Combining results from multiple scanning methods ensures complete coverage, since firewalls and filtering may hide hosts from any single technique.

## Phases

- [Reconnaissance](https://hackindex.io/services/hosts/reconnaissance.md): Guides for mapping hosts via passive OSINT, network sweeps, and active prob (3 guides)
- [Enumeration](https://hackindex.io/services/hosts/enumeration.md): Guides on host discovery, port scanning, OS fingerprinting, and NSE scans (4 guides)
- [Vulnerability Discovery](https://hackindex.io/services/hosts/vulnerability-discovery.md): Guides for scanning hosts to find CVEs and misconfigs with Nmap NSE (1 guides)
- [Data Exfiltration](https://hackindex.io/services/hosts/data-exfiltration.md): Exfiltrate data via ICMP when TCP and UDP egress is blocked (1 guides)