Host Discovery

Host discovery finds live targets on scope — run discovery only against $LAB_HOST, never dorm or café ranges.

Host Discovery• Audio Walkthrough

00:00/03:28

Visual · pentest_host_discovery

Host discovery literacy. $LAB_HOST only. Original Cyberlium.

Discovery answers 'what is up on scope?' — not 'what is up on the internet?'

Host discovery identifies responsive hosts within authorized scope: ping sweeps, ARP on local lab segment you own, targeted nmap -sn against $LAB_HOST IP only. Discovery precedes port scanning and must respect RoE timing and rate limits. Sweeping entire dorm subnets is unauthorized scanning — not OSCP methodology. Cyberlium teaches discovery commands conceptually on $LAB_HOST — one intentional target, logged notes, no stranger ranges. Next: Recon Lab.

1. Discovery stays inside scope CIDR

Enterprise testers discovery-scan only engagement-listed ranges. Your lab range is one IP: $LAB_HOST. Document command, timestamp, and result in notes before deeper enumeration.

If discovery returns unexpected neighbors, stop — do not add them. Redact stranger IPs from logs.

Command guide

Try these commands — Discovery stays inside scope CIDR

═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)

SYN scan — https://nmap.org/book/man-port-scanning-techniques.html RoE: no café /24 sweeps

═══ INSTALL ═══

Linux (Debian/Ubuntu):

Command — copy this

sudo apt install nmap

macOS:

Command — copy this

brew install nmap

Windows:

Command — copy this

choco install nmap  # or download https://nmap.org/download.html

═══ LINUX / macOS ═══

Command — copy this

source "$HOME/cyberlium-lab/t19-lab.env"
nmap -sn "$LAB_HOST"
nmap -Pn -sS -T4 --top-ports 100 "$LAB_HOST"

Primary tools to practice this lesson: nmap. Reference sites: SYN scan (https://nmap.org/book/man-port-scanning-techniques.html); RoE: no café /24 sweeps. Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.

2. Techniques and logging discipline

Common literacy: ping, nmap -sn, arp-scan on YOUR lab vSwitch only. Each active technique gets a log line: tool, target=$LAB_HOST, purpose=host discovery, RoE ref.

Rate limits and windows matter on production engagements. On lab VMs, still practice logging — habits transfer.

3. Discovery is not subnet tourism

Students sometimes 'discover' dorm /24 or café DHCP ranges because tools make it easy. That is out of scope and often illegal. Discovery without written authorization is the line you do not cross.

Ship: sample discovery log entry for $LAB_HOST only. Next: Recon Lab.

4. What you ship: host discovery log template for $LAB_HOST

Log template with tool, target=$LAB_HOST, timestamp, result. NEVER dorm/café ranges. chmod 600.

5. What you record before the next lesson

Date. Discovery log template. $LAB_HOST only target. File t19-m03-l03-host-discovery.txt chmod 600.

6. Wrong vs right: stranger nets vs YOUR lab VMs

Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.

Wrong: nmap -sn 192.168.1.0/24 on roommate network. Discover café DHCP 'for practice.'
Right: Write discovery log template for $LAB_HOST. Next: Recon Lab.

Hands-on Exercise