Penetration › Module 3 › Lesson 3
Host Discovery
Host discovery finds live targets on scope — run discovery only against $LAB_HOST, never dorm or café ranges.
Visual · pentest_host_discovery
Host discovery literacy. $LAB_HOST only. Original Cyberlium.
Opening
Discovery answers 'what is up on scope?' — not 'what is up on the internet?'
Host discovery identifies responsive hosts within authorized scope: ping sweeps, ARP on local lab segment you own, targeted nmap -sn against $LAB_HOST IP only. Discovery precedes port scanning and must respect RoE timing and rate limits. Sweeping entire dorm subnets is unauthorized scanning — not OSCP methodology. Cyberlium teaches discovery commands conceptually on $LAB_HOST — one intentional target, logged notes, no stranger ranges. Next: Recon Lab.
1. Discovery stays inside scope CIDR
Enterprise testers discovery-scan only engagement-listed ranges. Your lab range is one IP: $LAB_HOST. Document command, timestamp, and result in notes before deeper enumeration.
If discovery returns unexpected neighbors, stop — do not add them. Redact stranger IPs from logs.
Command guide
Try these commands — Discovery stays inside scope CIDR
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
SYN scan — https://nmap.org/book/man-port-scanning-techniques.html RoE: no café /24 sweeps
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install nmap
macOS:
Command — copy this
brew install nmap
Windows:
Command — copy this
choco install nmap # or download https://nmap.org/download.html
═══ LINUX / macOS ═══
Command — copy this
source "$HOME/cyberlium-lab/t19-lab.env" nmap -sn "$LAB_HOST" nmap -Pn -sS -T4 --top-ports 100 "$LAB_HOST"
Primary tools to practice this lesson: nmap. Reference sites: SYN scan (https://nmap.org/book/man-port-scanning-techniques.html); RoE: no café /24 sweeps. Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Techniques and logging discipline
Common literacy: ping, nmap -sn, arp-scan on YOUR lab vSwitch only. Each active technique gets a log line: tool, target=$LAB_HOST, purpose=host discovery, RoE ref.
Rate limits and windows matter on production engagements. On lab VMs, still practice logging — habits transfer.
3. Discovery is not subnet tourism
Students sometimes 'discover' dorm /24 or café DHCP ranges because tools make it easy. That is out of scope and often illegal. Discovery without written authorization is the line you do not cross.
Ship: sample discovery log entry for $LAB_HOST only. Next: Recon Lab.
4. What you ship: host discovery log template for $LAB_HOST
Log template with tool, target=$LAB_HOST, timestamp, result. NEVER dorm/café ranges. chmod 600.
5. What you record before the next lesson
Date. Discovery log template. $LAB_HOST only target. File t19-m03-l03-host-discovery.txt chmod 600.
6. Wrong vs right: stranger nets vs YOUR lab VMs
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
nmap -sn 192.168.1.0/24 on roommate network. Discover café DHCP 'for practice.'
Right
Write discovery log template for $LAB_HOST. Next: Recon Lab.
Mission: template discovery log for YOUR lab
1) Write log fields: tool, target, time, result, RoE ref. 2) Set target = $LAB_HOST only. 3) chmod 600. Never discovery-scan stranger subnets.
Stuck? Ask Cyberlium AI Mentor
One-IP discovery on owned lab beats sweeping a dorm every time.
Knowledge Check
APPLY: Host discovery in Cyberlium targets:
Multiple choice
Knowledge Check
APPLY: True or False: Unexpected neighbor response authorizes adding that host to scope.
True or False
Knowledge Check
APPLY: Discovery logs should include:
Multiple choice