They do like to test you and see what happens. And it's a game - at this age they really don't understand.

I say "I will not let you hurt me/your sister/your brother" and remove them or restrain them, if necessary. I have found that clearer language defining boundaries and consequences has been more effective than warnings, etc. "I will not" Is very clear. "I will have to take you home/stop playing with you/take that toy off you (if used as weapon), etc" are very clear consequences.
I generally don't do time out. As they get older, particularly, the violence tends to be a cry for more attention and means I need to spend more time with them.