Scanning in ethical hacking begins with identifying live hosts and open ports, then continues with enumeration, which collects detailed information about those systems, such as user accounts, shared resources, and service configurations.