Sweshi's Tutorials

Scanning Tool Tutorials

hping 3 tutorial

Share to Facebook
NOTICE: All the tutorials on this website are meant to help you find security vulnerabilties on your own network and devices to understand your security posture before black hats do. Penetration testing without a written consent is illegal and you can be prosecuted. Use these tutorials to secure your own networks or those whose permission you have been granted. Keep it ethical and keep it professional.
Table of Contents
hping3 introduction

Hping3 is quite a powerful tool that penetration testers can used for a number of things. It can be used for normal pings to test reachability of hosts, for port scanning, checking firewall status, OS fingerprinting using TTL values, guessing the uptime of a system and crafting packets. Because of the types of packets that can be sent, its a good tool for testing networks generally and for understanding the TCP/IP protocol stack.

Hping3 installation
sudo apt install hping3
hping3 usage example: simple syn ping

To carry out a simple ping with syn packets sent through port 80, we can use the following command to a target IP 192.168.43.141. TCP is the default transport layer protocol used. We can use different flags for different types of packets by changing -S which uses syn packets to other flags such as -U for urgent flag.

hping3 -S 192.168.43.141
hping3 usage example: port scanning

We can use the -p option as shown below to specify port 80. In the example, I have also limited the replies to only 4 using the -c option.

hping3 -S 192.168.43.141 -p 80 -c 4 hping3 tutorial: port scanning.
hping3 usage example: sending raw IP packets

Sometimes we want to emphasise IP packets without the transport layer header so we can do this by specifying raw IP as shown below.

hping3 -0 192.168.43.141 hping3 tutorial: sending raw ip packets.
hping3 usage example: changing to ICMP or UDP

We have used raw IP and TCP but we can also specify that we want UDP packets or ICMP packets

hping3 -1 192.168.43.141 #ICMP hping3 -2 192.168.43.141 #UDP
hping3 usage example:Scanning a range of ports

We have seen how we can use the -p to scan for a single port but we can actually scan a range of ports using the scan mode -8. In this case I will scan from 20 to 100.

hping3 -8 20-100 -A 192.168.43.141 hping3 tutorial: scanning a range of ports. hping3 tutorial: hping flooding.
hping3 usage example:ping sweep

We can scan a whole network if we want to know which hosts are up.

hping3 -1 192.168.43.x --rand-dest -I eth0
SYN Flood example

Syn floods can occur when we send a lot off syn packets towards an IP address on a specific port number. It can prevent other machines from connecting to it if successful. This is normally possible on older Operating Systems. This is also why you should update you system frequently.

  • -S sets the target IP address
  • -a sets the spoofed IP address that will be indicated as the source, effectively hiding our true IP.
  • -p 22 sets the port number to 22
  • --flood sends as many packets as possible
      • hping3 -S 192.168.43.141 -a 192.168.43.119 -p 22 --flood

      We can send specific packet types on a port number using the flooding option. In this case, since I am using syn packets (-S), this becomes a syn flood. This is a simple DOS attack on older TCP stacks that requires the IP address of the target to be spoofed so that the packets appear to be comming from a different source and not us. In this case they appear to be coming from 192.168.43.112. It will be sending a lot of packets very fast so it will not be showing the replies.

      hping3 -S 192.168.43.141 -a 192.168.43.112 -p 22 --flood

      hping3 cheat sheet and modes

      -V : verborse mode -a : spoof source address -c : packet count -0 : raw IP mode -1 : ICMP mode -2 : UDP mode -8 : SCAN mode -9 : listen mode -C : ICMP type -K : ICMP code -L : setting TCP ack -F : setting TCP FIN flag -I : interface -S : setting TCP SYN flag -R : setting TCP RST flag -A : seeting TCP ACK flag -U : setting TCP urgent flag -X : set unused flag (0x40) -Y : set unused flag (0x80) -faster: 100 packets per second -flood : send packets as fast as possible without showing replies