Foundations of Penetration Testing: Host Discovery & Port Scanning
Welcome to the foundational module on Host Discovery and Port Scanning, crucial techniques for any penetration tester, especially when preparing for certifications like the OSCP. Understanding how to identify active hosts on a network and what services they are running is the first step in uncovering potential vulnerabilities.
What is Host Discovery?
Host discovery, also known as network scanning or host enumeration, is the process of identifying live hosts (computers, servers, network devices) on a network. This is essential because you can only attack systems that you know exist. It helps map out the attack surface.
Common Host Discovery Techniques
| Technique | Protocol | Pros | Cons |
|---|---|---|---|
| ICMP Echo Request (Ping) | ICMP | Simple, widely understood, good for basic reachability. | Often blocked by firewalls, can be noisy. |
| ARP Scan | ARP | Effective on local networks, doesn't require IP routing. | Limited to the local subnet. |
| TCP SYN Scan | TCP | Can traverse firewalls, stealthier than full TCP connect. | Requires root/administrator privileges for raw sockets. |
| UDP Scan | UDP | Can find UDP services, less common than TCP. | Slower, less reliable responses, often blocked. |
What is Port Scanning?
Once active hosts are identified, port scanning is the next logical step. It involves probing each active host to discover which network ports are open, closed, or filtered. Open ports indicate running services that could potentially be exploited.
Types of Port Scans
Port scanning involves sending various types of packets to specific ports on a target host to determine their status. The most common types include: TCP SYN Scan (Stealth Scan): Sends a SYN packet and waits for a SYN/ACK (open) or RST (closed). If no response, it's filtered. This is efficient and less likely to be logged by applications. TCP Connect Scan: Attempts a full TCP connection. If successful, the port is open. This is reliable but easily logged. UDP Scan: Sends a UDP packet. An ICMP 'port unreachable' message indicates closed; no response or an application-specific response suggests open or filtered. FIN, NULL, XMAS Scans: These leverage TCP flags to infer port status, often used to bypass stateless firewalls.
Text-based content
Library pages focus on text content
Host discovery identifies which systems are active on a network, while port scanning identifies what services are running on those active systems.
Tools for Host Discovery and Port Scanning
Several powerful tools are available for performing host discovery and port scanning. Mastering these tools is fundamental for OSCP preparation and practical penetration testing.
Nmap (Network Mapper) is the Swiss Army knife for network exploration. It can perform host discovery, port scanning, OS detection, version detection, and more. Its versatility makes it indispensable.
Other notable tools include:
Loading diagram...
Key Takeaways for OSCP Preparation
For the OSCP exam, proficiency in these areas is non-negotiable. You'll need to quickly and accurately map out target networks. Practice using Nmap extensively, understanding its various scan types, timing options, and output formats. Be prepared to use other tools as well, depending on the scenario.
It reveals potential entry points (services) on a target system that could be vulnerable to exploitation.
Learning Resources
The official and most comprehensive documentation for Nmap, covering all its features, commands, and scripting capabilities.
A concise PDF cheat sheet from Offensive Security, perfect for quick reference during practice and exams.
A foundational course that covers the basics of penetration testing, including reconnaissance and scanning techniques.
Learn essential network enumeration techniques, including host discovery and port scanning, through interactive labs.
An article explaining the principles and common techniques of network scanning, with a focus on web application security context.
A general overview of port scanning, its history, types, and common uses.
A whitepaper detailing various network reconnaissance techniques, including host discovery and port scanning, from a security perspective.
A practical video tutorial demonstrating how to use Nmap for various scanning tasks, including host discovery and port scanning.
Information on Nmap as it's integrated into Kali Linux, including common commands and use cases.
Details on host discovery methods and tools available within the Network Security Toolkit.