Study guide
6.1 OS Fingerprinting, Service Discovery, and Host Discovery
CompTIA PenTest+ PT0-003
Track your progress as you read
Finished sections get a check mark.
1 Introduction & Exam Overview
1.1 Current PT0-003 Exam Facts 1.2 Format, PBQs, Scoring, and Retake Policy 1.3 Recertification, CEUs, and Career Fit
2 Pre-Engagement Planning
2.1 Scope, Rules of Engagement, and Agreements 2.2 Target Selection and Assessment Types 2.3 Shared Responsibility, Legal Authorization, and Ethics
3 Collaboration, Frameworks, and Threat Modeling
3.1 Collaboration, Escalation, and Stakeholder Communication 3.2 Testing Frameworks and Methodologies 3.3 Threat Modeling: STRIDE, DREAD, and OCTAVE
4 Reporting and Remediation
4.1 Penetration Test Report Components 4.2 Findings Analysis and Remediation Recommendations
5 Information Gathering
5.1 Active vs Passive Reconnaissance 5.2 OSINT Sources and Techniques 5.3 DNS, Certificate Transparency, and Search Engine Enumeration 5.4 Network Recon, Protocol Scanning, Sniffing, and Banner Grabbing
6 Enumeration Techniques
6.1 OS Fingerprinting, Service Discovery, and Host Discovery 6.2 DNS, Directory, Share, and Account Enumeration 6.3 Secrets, Permissions, and Wireless Enumeration 6.4 WAF Enumeration, Web Crawling, and Attack Path Mapping
7 Recon Scripting and Tools
7.1 Modifying Bash, Python, and PowerShell for Recon 7.2 Recon and Enumeration Tools
8 Vulnerability Scan Types
8.1 Network, Host, Authenticated, and Wireless Scans 8.2 SAST, DAST, IAST, SCA, IaC, and Mobile Scans 8.3 Container, Secrets, and ICS Vulnerability Assessment 8.4 Core Vulnerability Scanners (Nessus, OpenVAS, Nikto)
9 Scan Analysis and Physical Security
9.1 Specialized Discovery Tools 9.2 Validating Scan, Recon, and Enumeration Results 9.3 Public Exploit Selection and Scripted Validation 9.4 Physical Security Concepts for PenTests
10 Attack Prioritization and Preparation
10.1 Target Prioritization: CVSS, CVE, CWE, and EPSS 10.2 Exploit Selection, Customization, and Attack Documentation
11 Network Attacks
11.1 On-Path, VLAN Hopping, Relay, and Multihomed Hosts 11.2 Default Credentials, Misconfigured Services, Packet Crafting, and Certificate Services
12 Authentication Attacks
12.1 Pass-the-Hash, Pass-the-Ticket, Pass-the-Token, and Kerberos Attacks 12.2 Password Attacks, MFA Fatigue, LDAP Injection, OIDC, and SAML
13 Host-Based Attacks
13.1 Privilege Escalation and Credential Dumping 13.2 Process Injection, Security Bypass, and Host Attack Tools
14 Web Application Attacks
14.1 SQL, Command, XSS, and SSTI Injection 14.2 CSRF, SSRF, Deserialization, IDOR, and Directory Traversal 14.3 LFI/RFI, Web Shells, API Abuse, JWT, and Session Hijacking
15 Cloud Attacks
15.1 IAM Misconfiguration, Metadata Service, and Exposed Storage 15.2 Container Escape, Supply Chain, and Cloud Attack Tools
16 Wireless and Social Engineering
16.1 Wireless Attacks and Tools 16.2 Phishing, Spearphishing, Whaling, Vishing, and Smishing 16.3 Physical Social Engineering and SE Tools
17 Specialized Systems
17.1 Mobile Attacks and AI Prompt/Model Attacks 17.2 OT/ICS, NFC, RFID, and Bluetooth Attacks
18 Attack Scripting and BAS
18.1 PowerShell, Python, and Bash Attack Automation 18.2 Breach and Attack Simulation (Caldera, Infection Monkey, Atomic Red Team)
19 Persistence
19.1 Scheduled Tasks, Services, Accounts, and Shells 19.2 C2, Backdoors, Rootkits, and Security-Control Tampering
20 Lateral Movement
20.1 Pivoting, Relays, and Additional Credential Capture 20.2 Remote Services: SMB, RDP, WinRM, WMI, SSH, and Others 20.3 Lateral Movement Tools and LOLbins
21 Exfiltration and Cleanup
21.1 Staging and Exfiltration 21.2 Cleanup, Restoration, and Artifact Preservation
6.1 OS Fingerprinting, Service Discovery, and Host Discovery
Key Takeaways Explain This Topic AI
PT0-003 objective 2.2 is enumeration: after reconnaissance shows something exists, you inventory what exactly is on the host or service.
Host discovery asks which in-scope addresses are alive, using ICMP, ARP, or limited TCP/UDP probes — not a full version scan of the CIDR.
Service discovery inventories open ports and products, such as SMB on TCP 445 and RDP on TCP 3389.
OS fingerprinting infers the guest OS from TTL, TCP window size, and TCP option stacks; an open SMB port is not an OS fingerprint because Samba runs on Linux.
Protocol enumeration records how a discovered service is configured, such as SMB dialects and whether signing is required.
Last updated: August 2026
Enumeration on CompTIA PenTest+ PT0-003 starts after reconnaissance has shown that something exists. Objective 2.2 — Given a scenario, apply enumeration techniques — sits in Domain 2 (Reconnaissance and Enumeration, 21 percent of the exam). Objective 2.1 is information gathering: open-source intelligence, DNS lookups, sniffing, and banner grabbing. Objective 2.2 is the inventory of what exactly is on this host or service . Exam writers mix four techniques that are not synonyms: host discovery , service discovery , operating system (OS) fingerprinting , and protocol enumeration . If you pick an OS guess when the stem only asked which addresses are alive, you missed the item.
Host discovery: which addresses are alive?
Host discovery answers a binary question for each in-scope address: is anything there? Typical probes include Internet Control Message Protocol (ICMP) echo requests, Address Resolution Protocol (ARP) on a local Ethernet or Wi-Fi segment, Transmission Control Protocol (TCP) SYN or ACK packets to a short list of common ports, and User Datagram Protocol (UDP) probes to ports that usually elicit a response. A host that replies, sends a TCP reset, or otherwise proves presence is live. A host that stays silent is not proven absent. Host-based firewalls, ICMP filters, cloud security groups, and network address translation can hide a system that still serves a single allowed port.
Exam trap: treating a full version scan of every address in a Classless Inter-Domain Routing (CIDR) block as "discovery." Version detection is service discovery — and often OS fingerprinting — at warehouse scale. Another trap: believing an ICMP-only "down" result authorizes you to skip the host. Rules of engagement may require a TCP host-discovery pass when ICMP is filtered, especially on Internet-facing cloud ranges.
On an internal virtual LAN, ARP is often more honest than ICMP because you see Layer-2 replies even when ICMP is dropped. On the public Internet, ICMP is frequently blocked, so testers use TCP probes to ports such as 80, 443, 22, or 445 as the discovery channel. Record which method produced the live set. Later Domain 3 items on scan completeness will ask whether you missed hosts because discovery was too timid.
Service discovery: which ports and products?
Service discovery starts after you have a live host, or when the statement of work already named one. It inventories open ports and the listening products: TCP 445 with Server Message Block (SMB), TCP 3389 with Remote Desktop Protocol (RDP), TCP 22 with Secure Shell (SSH), UDP 161 with Simple Network Management Protocol (SNMP), TCP 389 or 636 with Lightweight Directory Access Protocol (LDAP). Banners, handshake bytes, and default ports are clues, not conclusions. A listener on 8443 might be a web administration console, a reverse proxy, or a development application programming interface (API).
Service discovery is still inventory. You are listing what is exposed. You are not yet walking shares, dumping users, or exploiting a banner version. Conceptually this is the Nmap port-scan and service-detection stage; objective 2.4 is where you pick Nmap Scripting Engine (NSE) scripts by name. On the exam, "which ports are open?" is service discovery even if the same screenshot also prints an OS guess.
OS fingerprinting: which guest operating system?
OS fingerprinting infers the guest operating system from how the TCP/IP stack behaves. Active fingerprinting sends crafted probes and compares time-to-live (TTL) values, TCP window sizes, TCP option order, Don't Fragment bits, and ICMP error formats to a signature database. Passive fingerprinting watches traffic you are already allowed to see — useful when the rules of engagement limit noisy probes. A result such as "Windows Server 2019" or "Linux 5.x" is a hypothesis. Virtualization, stack hardening, load balancers, and intentional OS-spoof settings produce confident-looking wrong answers.
Exam trap: a port is not an OS
A TTL "near 128" is not proof you may skip Linux-only checks. An open SMB port is not OS fingerprinting by itself: Samba on Linux speaks SMB. RDP on 3389 usually indicates a Windows-family host, but it can be a jump box, a virtual desktop gateway, or a third-party RDP service. Treat the OS label as a pointer to which protocol details to enumerate next, not as a finding you would ship without corroboration.
Protocol enumeration: how does this instance speak?
Protocol enumeration is the 2.2 bullet exam writers hide inside "what should the tester do next?" After you know SMB is on 445, you enumerate dialects, whether signing is required , whether guest or null sessions are accepted, and which SMB features are advertised. After HTTP is confirmed on 443, you enumerate methods, security headers, Transport Layer Security (TLS) versions, and authentication schemes. After SNMP is confirmed, you enumerate community strings and management information base (MIB) access if the RoE allows. Protocol enumeration is not host discovery (you already have the host) and not merely service discovery (you already know the port). It is the configuration and feature set of that protocol on that host.
Worked example: 445 and 3389
Host discovery marks 10.4.12.8 live. Service discovery shows TCP 445 and TCP 3389 open. OS fingerprinting reports Windows Server 2019 . Protocol enumeration against SMB shows signing is not required . Those four facts are four different objective 2.2 techniques, not one "Nmap result." Together they start an attack path you will keep mapping in the rest of this chapter: a Windows file server that still talks unsigned SMB and also offers RDP. Do not jump to exploitation. Write the inventory first.
Technique Question it answers Typical evidence Not the same as
Host discovery Which addresses are alive? ICMP, ARP, or limited TCP replies from 10.4.12.8 A version scan of every port on the CIDR
- Service discovery Which ports and products? 445/tcp SMB, 3389/tcp RDP Guessing Windows from a TTL alone
- OS fingerprinting Which OS family and version? TTL, window, TCP options → Server 2019 Listing SMB shares
- Protocol enumeration How is this service configured? SMB dialects; signing not required Proving the host is up
Sequence on the exam: discover the host, discover the services, fingerprint the OS, then enumerate protocol details. Skipping ahead looks like efficiency and is usually the distractor.