9.1.0 Stage 01: Discovery and Scanning
← Main index | Strategy map | Study methods: Discover attack surfaces
Quick use: Discovery and scanning cheatsheet
Paired study stage: Stage 02 service enumeration. Stage 01 produces its input queue; Stage 02 may return new hosts, listeners or routes here.
Purpose: establish scope and source position, discover reachable endpoints, identify application clues, preserve coverage limits and build the next enumeration queue.
| Order | Task | Use it to |
|---|---|---|
| 1 | Path and host discovery | Check the selected source/interface and discover explicitly assigned hosts |
| 2 | TCP scanning | Get quick leads and complete TCP coverage |
| 3 | Service identification | Probe discovered ports for application and OS clues |
| 4 | UDP scanning | Check UDP separately and preserve ambiguous results |
| 5 | Results and next actions | Verify decisive results and build the service queue |
| 6 | Windows network checks | Test endpoints from a Windows source position |
| 7 | Scanner alternatives | Use RustScan/Masscan for candidate discovery or Nikto for bounded web checks, then validate manually |
Exit condition: you can state the scan source, tested target/transport/ports, observed endpoints, application confidence, remaining coverage gaps and the next service-specific test, then carry that complete tuple into Stage 02.