OPSECTLAS you are here: Network
Network

Host Discovery

reference 10 commands 1 tool

  1. Recon
  2. Enumerate
  3. Foothold
  4. PrivEsc
  5. Lateral
  6. Post-Ex

reached from External access only

toolsnmap
External (Single Target Known)

Verify the target is alive

ping -c 4 <TARGET-IP>
nmap -sn <TARGET-IP>
Internal Network Discovery

ARP scan · most reliable on local /24 (Layer 2, bypasses host firewall)

arp-scan -l                          # Scan local network
arp-scan --interface=eth0 <RANGE>

Nmap ping sweep

nmap -sn <RANGE> -oA scans/host_discovery
nmap -sn 192.168.1.0/24 --exclude <YOUR-IP>

netdiscover (passive + active ARP)

netdiscover -r <RANGE> -i eth0
netdiscover -p            # Passive mode only · just listen

fping · fast ICMP sweep

fping -a -g <RANGE> 2>/dev/null

masscan · fastest port scanner for large ranges

masscan -p80,443,445,22 <RANGE> --rate=1000 -oL scans/masscan_results.txt