15 discover command

discover Command

Language: English (en-US) | pt-BR: ../pt-BR/15-comando-discover.md

Overview

discover performs network discovery on a subnet or individual host, fingerprints live devices, and matches them against the EmbedXPL exploit catalog. It is session-aware: if a host was scanned before, previous findings are displayed and the scan resumes from where it stopped.

Syntax

discover <subnet/CIDR>
discover <IP>
discover <subnet/CIDR> --fresh
discover -T <targets.txt>
discover -T <targets.txt> --fresh

Parameters

Parameter	Type	Description
`<subnet/CIDR>`	string	IPv4 address or CIDR notation (e.g. `192.168.1.0/24`, `10.0.0.1`)
`--fresh`	flag	Ignore saved session data; perform a full rescan from zero
`-T <file>`	string	Path to a plain-text file with one IP or CIDR per line

Standard discovery — single CIDR

exf> discover 192.168.1.0/24

[*] Starting network discovery on 192.168.1.0/24
[*] [arp_ping] Sending ARP broadcast to 192.168.1.0/24
[*] [port_scan] Scanning live hosts: 80,443,23,22,554,8080,8443,7547,37777,9100,631
[*] [banner_grab] Grabbing HTTP/RTSP/Telnet banners
[*] [fingerprint] Matching vendor OUI and HTTP fingerprints
[*] [catalog_match] Matching hosts to exploit catalog
[*] [wireless_check] Checking for wireless SSIDs

┌────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┐
│                                       Discovered Hosts (5)                                                                 │
├─────────────────┬───────────────────┬──────────────────┬───────────────────────────┬──────────────────┬────────────────────┤
│ IP              │ MAC               │ Hostname         │ Ports                     │ Vendor           │ Model              │
├─────────────────┼───────────────────┼──────────────────┼───────────────────────────┼──────────────────┼────────────────────┤
│ 192.168.1.1     │ EC:08:6B:1A:2C:40 │ -                │ 80,443,22                 │ TP-Link          │ TL-WR841N          │
│ 192.168.1.100   │ AC:CC:8E:5A:10:F2 │ DVR-001          │ 80,554,8000,37777         │ Hikvision        │ DS-7608NI-K2       │
│ 192.168.1.101   │ 00:E0:4C:3B:12:AA │ -                │ 80,37777                  │ Dahua            │ IPC-HDW2831T       │
│ 192.168.1.200   │ 00:09:0F:AA:00:01 │ fw-perimeter     │ 80,443,8443               │ Fortinet         │ FortiGate-200F     │
│ 192.168.1.254   │ 18:E8:29:01:B4:CC │ router-main      │ 80,443,22,23              │ Cisco            │ RV325              │
└─────────────────┴───────────────────┴──────────────────┴───────────────────────────┴──────────────────┴────────────────────┘

(continued with Confidence, Modules, Tested, Pending, WiFi columns)
┌─────────────────┬────────────┬─────────┬─────────┬────────┬──────┐
│ IP              │ Confidence │ Modules │ Tested  │ Pending│ WiFi │
├─────────────────┼────────────┼─────────┼─────────┼────────┼──────┤
│ 192.168.1.1     │ 92%        │ 6       │ 0       │ 6      │ Yes  │
│ 192.168.1.100   │ 88%        │ 14      │ 0       │ 14     │ -    │
│ 192.168.1.101   │ 81%        │ 8       │ 0       │ 8      │ -    │
│ 192.168.1.200   │ 95%        │ 12      │ 0       │ 12     │ -    │
│ 192.168.1.254   │ 90%        │ 5       │ 0       │ 5      │ Yes  │
└─────────────────┴────────────┴─────────┴─────────┴────────┴──────┘

[+]
[+] 5 host(s) matched against the exploit catalog:

  192.168.1.1 [TP-Link] TL-WR841N -- 6 exploit module(s)
    use exploits/routers/tplink/wr841n_credential_disclosure_cve_2023_50224  [pending]
    use exploits/routers/tplink/wr841n_parental_control_rce_cve_2025_9377    [pending]
    use exploits/routers/tplink/multi_dns_hijack_apt28                       [pending]
    use creds/routers/tplink/ssh_default_creds                               [pending]
    use creds/routers/tplink/telnet_default_creds                            [pending]
    use creds/routers/tplink/http_default_creds                              [pending]

  192.168.1.100 [Hikvision] DS-7608NI-K2 -- 14 exploit module(s)
    use exploits/cameras/hikvision/rtsp_rce_cve_2021_36260                   [pending]
    use exploits/cameras/hikvision/info_disclosure_cve_2017_7921             [pending]
    use exploits/cameras/hikvision/psh_command_injection                     [pending]
    use exploits/cameras/hikvision/nas_auth_bypass_cve_2023_28808            [pending]
    use exploits/cameras/hikvision/firmware_crypto_key_extract               [pending]
    ... and 9 more

  192.168.1.101 [Dahua] IPC-HDW2831T -- 8 exploit module(s)
    use exploits/cameras/dahua/cctv_auth_bypass_cve_2021_33044               [pending]
    use exploits/cameras/dahua/cctv_rce_cve_2021_36260                       [pending]
    use exploits/cameras/dahua/auth_bypass_cve_2021_33044                    [pending]
    use exploits/cameras/dahua/cctv_username_disclosure_cve_2020_25078       [pending]
    use exploits/cameras/dahua/dvr_auth_bypass_cve_2013_6117                 [pending]
    ... and 3 more

  192.168.1.200 [Fortinet] FortiGate-200F -- 12 exploit module(s)
    use exploits/firewalls/fortinet/fortios_auth_bypass_cve_2022_40684       [pending]
    use exploits/firewalls/fortinet/fortios_sslvpn_rce_cve_2024_21762        [pending]
    use exploits/firewalls/fortinet/fortigate_ssl_vpn_heap_overflow_cve_2023_27997 [pending]
    use exploits/firewalls/fortinet/fortios_sslvpn_path_traversal_cve_2018_13379   [pending]
    use exploits/firewalls/fortinet/fortimanager_fortijump_cve_2024_47575    [pending]
    ... and 7 more

  192.168.1.254 [Cisco] RV325 -- 5 exploit module(s)
    use exploits/routers/cisco/rv320_command_injection                       [pending]
    use exploits/routers/cisco/rv300_rv320_information_disclosure_cve_2019_1653  [pending]
    ... and 3 more

╔════════════════════════════════════════════════════════════════════╗
║ WirelessXPL-Forge  COMPLEMENTARY                                   ║
║ 192.168.1.1 (TP-Link TL-WR841N)  SSIDs: HomeNet_5G, HomeNet_2G    ║
║                                                                    ║
║ This device has wireless interfaces. WirelessXPL-Forge can test:   ║
║  - WPA2/WPA3 handshake capture and offline cracking               ║
║  - Deauth and PMKID attacks                                        ║
║  - SSID enumeration and hidden network detection                   ╚

Discovery with `--fresh` (ignore session history)

exf> discover 192.168.1.0/24 --fresh

[*] Starting network discovery on 192.168.1.0/24
[*] --fresh flag: ignoring saved session data

... (full discovery output, same as above) ...

[*] 5 new session(s) created

Session resume behavior (without `--fresh`)

When discover finds a host that was scanned before, it shows the previous session and resumes from pending modules:

exf> discover 192.168.1.0/24

[*] Starting network discovery on 192.168.1.0/24
...

SESSION FOUND for 192.168.1.100 (AC:CC:8E:5A:10:F2) — last scan: 2026-05-29 14:32, tested: 9, vulns: 2
  9 module(s) already tested, 5 pending — resuming from where it stopped
  Previous vulns:
    • exploits/cameras/hikvision/rtsp_rce_cve_2021_36260
    • exploits/cameras/hikvision/info_disclosure_cve_2017_7921

SESSION FOUND for 192.168.1.200 (00:09:0F:AA:00:01) — last scan: 2026-05-30 09:15, tested: 4, vulns: 0
  4 module(s) already tested, 8 pending — resuming from where it stopped

[+]
[+] 2 host(s) resumed from session history, 3 new
[dim]Use 'discover 192.168.1.0/24 --fresh' to ignore history and rescan from zero

... (results table) ...

  192.168.1.100 [Hikvision] DS-7608NI-K2 -- 14 exploit module(s)
    use exploits/cameras/hikvision/rtsp_rce_cve_2021_36260     VULN
    use exploits/cameras/hikvision/info_disclosure_cve_2017_7921  VULN
    use exploits/cameras/hikvision/psh_command_injection        tested
    use exploits/cameras/hikvision/nas_auth_bypass_cve_2023_28808  tested
    use exploits/cameras/hikvision/firmware_crypto_key_extract  tested
    use exploits/cameras/hikvision/psh_challenge_predictor      pending
    use exploits/cameras/hikvision/nvr_dvr_serial_privesc       pending
    ... and 5 more (pending)

Discover single host

exf> discover 10.0.0.1

[*] Starting network discovery on 10.0.0.1
[*] [arp_ping] Checking 10.0.0.1...
[*] [port_scan] Scanning: 80,443,22,23,8080,8443
[*] [banner_grab] HTTP banner: Cisco IOS XE 17.3.4
[*] [fingerprint] Matched vendor: Cisco | model: IOS XE router
[*] [catalog_match] Matching against exploit catalog...

┌────────────────────────────────────────────────────────────┐
│             Discovered Hosts (1)                           │
├───────────┬─────────────────┬────────┬───────────┬─────────┤
│ IP        │ MAC             │ Ports  │ Vendor    │ Model   │
├───────────┼─────────────────┼────────┼───────────┼─────────┤
│ 10.0.0.1  │ 00:1A:2B:3C:4D:5E│443,22 │ Cisco     │IOS XE   │
└───────────┴─────────────────┴────────┴───────────┴─────────┘

[+] 1 host(s) matched against the exploit catalog:
  10.0.0.1 [Cisco] IOS XE router -- 3 exploit module(s)
    use exploits/network_os/cisco/ios_xe_webui_privesc_cve_2023_20198  [pending]
    use exploits/firewalls/cisco/asa_ftd_path_traversal_cve_2020_3452  [pending]
    use creds/routers/cisco/ssh_default_creds                          [pending]

Discover from targets file (`-T`)

Targets file format

# targets.txt
# One IP or CIDR per line, blank lines and # comments ignored
192.168.1.0/24
10.0.0.1
172.16.0.0/23
# 192.168.2.0/24   (commented out)

Interactive shell usage

exf> discover -T /path/to/targets.txt

[*] Multi-target scan from file: /path/to/targets.txt
[*] [192.168.1.0/24] [arp_ping] Sending ARP broadcast...
[*] [10.0.0.1] [port_scan] Scanning ports...
[*] [172.16.0.0/23] [arp_ping] Sending ARP broadcast...
[+] [192.168.1.0/24] done — 5 host(s) found
[+] [10.0.0.1] done — 1 host(s) found
[+] [172.16.0.0/23] done — 12 host(s) found

Scan complete — 3 target(s), 18 total host(s) found

  192.168.1.0/24 — 5 host(s):
    192.168.1.1    TP-Link TL-WR841N  ports=[80,443,22]  conf=92%  modules=6
    192.168.1.100  Hikvision DS-7608NI-K2  ports=[80,554,37777]  conf=88%  modules=14
    192.168.1.101  Dahua IPC-HDW2831T  ports=[80,37777]  conf=81%  modules=8
    192.168.1.200  Fortinet FortiGate  ports=[80,443,8443]  conf=95%  modules=12
    192.168.1.254  Cisco RV325  ports=[80,22,23]  conf=90%  modules=5

  10.0.0.1 — 1 host(s):
    10.0.0.1  Cisco IOS XE  ports=[443,22]  conf=87%  modules=3

  172.16.0.0/23 — 12 host(s):
    172.16.0.1   ... (12 entries) ...

Non-interactive (`-T` as CLI flag)

python -m embedxpl -T /path/to/targets.txt

Output is identical. The tool scans all targets in parallel (up to 4 file workers) and exits after completion.

No live hosts found

exf> discover 10.255.0.0/24

[*] Starting network discovery on 10.255.0.0/24
[*] [arp_ping] Sending ARP broadcast to 10.255.0.0/24
[WARN] No live hosts found on 10.255.0.0/24

Invalid target

exf> discover not-an-ip

[-] Invalid target: 'not-an-ip'. Use IP or CIDR notation.

exf> discover 999.0.0.0/24

[-] Invalid target: '999.0.0.0/24'. Use IP or CIDR notation.

Missing argument

exf> discover

[-] Usage: discover <subnet/CIDR>  |  discover -T <targets.txt>

Discovery data stored per host

For each discovered host, discover stores in the session:

Field	Description
`ip`	IP address
`mac`	MAC address (if determinable via ARP)
`hostname`	DNS hostname or PTR record
`vendor`	Vendor guess from OUI + HTTP fingerprint
`model`	Model guess from banner/HTTP headers
`open_ports`	List of open TCP ports
`banners`	HTTP/Telnet/RTSP banner strings per port
`fingerprint_confidence`	0.0–1.0 float, % certainty of vendor/model match
`matched_modules`	List of EmbedXPL module paths that match this host
`has_wireless`	True if wireless interfaces/SSIDs were detected
`wireless_ssids`	List of SSID names if detected
`wireless_recommendation`	Cross-reference message for WirelessXPL-Forge

Use sessions show <ip> to inspect the stored data. See 16-sessions-command.md.

WirelessXPL-Forge cross-reference

When discover finds a device with wireless interfaces, it prints a panel recommending WirelessXPL-Forge:

╔══════════════════════════════════════════════════════════════════════╗
║ WirelessXPL-Forge  RECOMMENDED                                        ║
║ 192.168.1.1 (TP-Link Unknown)  SSIDs: HomeNet_5G, HomeNet_2G         ║
║                                                                       ║
║ No wired exploit modules matched this host. WirelessXPL-Forge can    ║
║ test the wireless interface independently:                            ║
║  - WPA2/WPA3 handshake capture with hashcat/aircrack-ng              ║
║  - PMKID attack (clientless)                                          ║
║  - Deauthentication and evil twin attacks                             ║
║  pip install wirelessxpl && wfx                                       ╚

The panel is RECOMMENDED (magenta border) when no wired exploit modules matched, or COMPLEMENTARY (cyan border) when wired modules also matched.

Timing reference

Network size	Typical scan time
Single host	3–8 seconds
/30 (4 hosts)	5–12 seconds
/24 (256 hosts)	30–90 seconds
/22 (1024 hosts)	2–5 minutes
/16 (65536 hosts)	20–60 minutes

Timing depends on ARP response latency, open port count, and banner grab timeouts.

EmbedXPL-Forge v3.2.1 | GitHub | PyPI | Issues

pip install embedxpl | pip install firewallxpl | pip install printerxpl-forge | pip install wirelessxpl | pip install mikrotikapi-bf

EmbedXPL-Forge v3.4.0

Home | Home-pt-BR

English (en-US)

Getting Started

Modules

Shell & Post-Exploitation

Tools & Infrastructure

Reference

Portugues (pt-BR)

Comecar

Modulos

Shell e Pos-Exploracao

Ferramentas e Infraestrutura

Referencia

15 discover command

discover Command

Overview

Syntax

Parameters

Standard discovery — single CIDR

Discovery with --fresh (ignore session history)

Session resume behavior (without --fresh)

Discover single host

Discover from targets file (-T)

Targets file format

Interactive shell usage

Non-interactive (-T as CLI flag)

No live hosts found

Invalid target

Missing argument

Discovery data stored per host

WirelessXPL-Forge cross-reference

Timing reference

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Discovery with `--fresh` (ignore session history)

Session resume behavior (without `--fresh`)

Discover from targets file (`-T`)

Non-interactive (`-T` as CLI flag)