Hping3 is quite a powerful tool that penetration testers can used for a number of things. It can be used for normal pings to test reachability of hosts, for port scanning, checking firewall status, OS fingerprinting using TTL values, guessing the uptime of a system and crafting packets. Because of the types of packets that can be sent, its a good tool for testing networks generally and for understanding the TCP/IP protocol stack.
sudo apt install hping3
To carry out a simple ping with syn packets sent through port 80, we can use the following command to a target IP 192.168.43.141. TCP is the default transport layer protocol used. We can use different flags for different types of packets by changing -S which uses syn packets to other flags such as -U for urgent flag.
hping3 -S 192.168.43.141
We can use the -p option as shown below to specify port 80. In the example, I have also limited the replies to only 4 using the -c option.
hping3 -S 192.168.43.141 -p 80 -c 4
Sometimes we want to emphasise IP packets without the transport layer header so we can do this by specifying raw IP as shown below.
hping3 -0 192.168.43.141
We have used raw IP and TCP but we can also specify that we want UDP packets or ICMP packets
hping3 -1 192.168.43.141 #ICMP
hping3 -2 192.168.43.141 #UDP
We have seen how we can use the -p to scan for a single port but we can actually scan a range of ports using the scan mode -8. In this case I will scan from 20 to 100.
hping3 -8 20-100 -A 192.168.43.141
We can scan a whole network if we want to know which hosts are up.
hping3 -1 192.168.43.x --rand-dest -I eth0
Syn floods can occur when we send a lot off syn packets towards an IP address on a specific port number. It can prevent other machines from connecting to it if successful. This is normally possible on older Operating Systems. This is also why you should update you system frequently.
hping3 -S 192.168.43.141 -a 192.168.43.119 -p 22 --flood
We can send specific packet types on a port number using the flooding option. In this case, since I am using syn packets (-S), this becomes a syn flood. This is a simple DOS attack on older TCP stacks that requires the IP address of the target to be spoofed so that the packets appear to be comming from a different source and not us. In this case they appear to be coming from 192.168.43.112. It will be sending a lot of packets very fast so it will not be showing the replies.
hping3 -S 192.168.43.141 -a 192.168.43.112 -p 22 --flood
hping3 cheat sheet and modes
-V : verborse mode
-a : spoof source address
-c : packet count
-0 : raw IP mode
-1 : ICMP mode
-2 : UDP mode
-8 : SCAN mode
-9 : listen mode
-C : ICMP type
-K : ICMP code
-L : setting TCP ack
-F : setting TCP FIN flag
-I : interface
-S : setting TCP SYN flag
-R : setting TCP RST flag
-A : seeting TCP ACK flag
-U : setting TCP urgent flag
-X : set unused flag (0x40)
-Y : set unused flag (0x80)
-faster: 100 packets per second
-flood : send packets as fast as possible without showing replies