Network
Host Discovery
reference
- Recon
- Enumerate
- Foothold
- PrivEsc
- Lateral
- Post-Ex
reached from External access only
External (Single Target Known)
Verify the target is alive
ping -c 4 <TARGET-IP>
nmap -sn <TARGET-IP>
Internal Network Discovery
ARP scan · most reliable on local /24 (Layer 2, bypasses host firewall)
arp-scan -l # Scan local network
arp-scan --interface=eth0 <RANGE>
Nmap ping sweep
nmap -sn <RANGE> -oA scans/host_discovery
nmap -sn 192.168.1.0/24 --exclude <YOUR-IP>
netdiscover (passive + active ARP)
netdiscover -r <RANGE> -i eth0
netdiscover -p # Passive mode only · just listen
fping · fast ICMP sweep
fping -a -g <RANGE> 2>/dev/null
masscan · fastest port scanner for large ranges
masscan -p80,443,445,22 <RANGE> --rate=1000 -oL scans/masscan_results.txt