Hping2
Jump to navigation
Jump to search
Description
Hping2 is a network tool able to send custom ICMP/UDP/TCP packets and to display target replies like ping do with ICMP replies. Hping2 handles fragmentation, arbitrary packet body and size and can be used in order to transfer files under supported protocols.
Hping2 can be used, among other things to:
- Test firewall rules,
- [spoofed] port scanning,
- Test net performance using differents protocols, packet size, TOS (type of service) and fragmentation,
- Path MTU discovery,
- Files transfering even between really fascist firewall rules,
- Traceroute like under different protocols,
- Firewalk like usage,
- Remote OS fingerprint,
- TCP/IP stack auditing
It's also really a good didactic tool to learn TCP/IP.
Installation
$ cd /data/src/ $ wget http://www.hping.org/hping2.0.0-rc3.tar.gz $ tar xzvf hping2.0.0-rc3.tar.gz $ .configure $ make $ sudo make install
It installs hping2 in /usr/sbin/hping2
Usage
Basic syntax
$ hping2 host [options]
Options
Mode
Note
Notice that without precision, the default mode is TCP
- -0, --rawip
- RAW IP mode
- -1, --icmp
- ICMP mode
- -2, --udp
- UDP mode
- -8, --scan
- SCAN mode.
- Example: hping --scan 1-30,70-90 -S www.target.host
- -9, --listen
- listen mode
IP
- -a, --spoof
- spoof source address
- --rand-dest
- random destionation address mode. see the man.
- --rand-source
- random source address mode. see the man.
- -t --ttl
- ttl (default 64)
- -N --id
- id (default random)
- -W --winid
- use win* id byte ordering
- -r --rel
- relativize id field
- (to estimate host traffic)
- -f --frag
- split packets in more frag.
- (may pass weak acl)
- -x --morefrag
- set more fragments flag
- -y --dontfrag
- set dont fragment flag
- -g --fragoff
- set the fragment offset
- -m --mtu
- set virtual mtu, implies --frag if packet size > mtu
- -o --tos
- type of service (default 0x00), try --tos help
- -G --rroute
- includes RECORD_ROUTE option and display the route buffer
- --lsrr
- loose source routing and record route
- --ssrr
- strict source routing and record route
- -H --ipproto
- set the IP protocol field, only in RAW IP mode
ICMP
- -C --icmptype
- icmp type (default echo request)
- -K --icmpcode
- icmp code (default 0)
- --force-icmp
- send all icmp types (default send only supported types)
- --icmp-gw
- set gateway address for ICMP redirect (default 0.0.0.0)
- --icmp-ts
- Alias for --icmp --icmptype 13 (ICMP timestamp)
- --icmp-addr
- Alias for --icmp --icmptype 17 (ICMP address subnet mask)
- --icmp-help
- display help for others icmp options
UDP/TCP
- -s --baseport
- base source port (default random)
- -p --destport [+][+]<port>
- destination port(default 0) ctrl+z inc/dec
- -k --keep
- keep still source port
- -w --win
- winsize (default 64)
- -O --tcpoff
- set fake tcp data offset (instead of tcphdrlen / 4)
- -Q --seqnum
- shows only tcp sequence number
- -b --badcksum
- (try to) send packets with a bad IP checksum many systems will fix the IP checksum sending the packet so you'll get bad UDP/TCP checksum instead.
- -M --setseq
- set TCP sequence number
- -L --setack
- set TCP ack
- -F --fin
- set FIN flag
- -S --syn
- set SYN flag
- -R --rst
- set RST flag
- -P --push
- set PUSH flag
- -A --ack
- set ACK flag
- -U --urg
- set URG flag
- -X --xmas
- set X unused flag (0x40)
- -Y --ymas
- set Y unused flag (0x80)
- --tcpexitcode
- use last tcp->th_flags as exit code
- --tcp-timestamp
- enable the TCP timestamp option to guess the HZ/uptime
Common
- -d --data
- data size (default is 0)
- -E --file
- data from file
- -e --sign
- add 'signature'
- -j --dump
- dump packets in hex
- -J --print
- dump printable characters
- -B --safe
- enable 'safe' protocol
- -u --end
- tell you when --file reached EOF and prevent rewind
- -T --traceroute
- traceroute mode (implies --bind and --ttl 1)
- --tr-stop
- Exit when receive the first not ICMP in traceroute mode
- --tr-keep-ttl
- Keep the source TTL fixed, useful to monitor just one hop
- --tr-no-rtt
- Don't calculate/show RTT information in traceroute mode ARS packet description (new, unstable)
- --apd-send
- Send the packet described with APD (see docs/APD.txt)
Other options
- -h --help
- show help
- -v --version
- show version
- -c --count
- packet count
- -i --interval
- wait (uX for X microseconds, for example -i u1000)
- --fast
- alias for -i u10000 (10 packets for second)
- -n --numeric
- numeric output
- -q --quiet
- quiet
- -I --interface
- interface name (otherwise default routing interface)
- -V --verbose
- verbose mode
- -D --debug
- debugging info
- -z --bind
- bind ctrl+z to ttl (default to dst port)
- -Z --unbind
- unbind ctrl+z
Example
Open port
Following command checks the status of port 22/tcp with a TCP SYN scan:
$ sudo hping2 -c 1 -I wlan0 -S -p 22 192.168.100.1 HPING 192.168.100.1 (wlan0 192.168.100.1): S set, 40 headers + 0 data bytes len=46 ip=192.168.100.1 ttl=64 DF id=0 sport=22 flags=SA seq=0 win=5840 rtt=2.3 ms --- 192.168.100.1 hping statistic --- 1 packets tramitted, 1 packets received, 0% packet loss round-trip min/avg/max = 2.3/2.3/2.3 ms
As we receive a SYN/ACK flag as response, we deduce that port 22/tcp is open.
Closed port
Following command sends a TCP SYN packet to port 81/tcp on host 192.168.100.1:
$ sudo hping2 -c 1 -I wlan0 -S -p 81 192.168.100.1 HPING 192.168.100.1 (wlan0 192.168.100.1): S set, 40 headers + 0 data bytes len=46 ip=192.168.100.1 ttl=64 DF id=0 sport=81 flags=RA seq=0 win=0 rtt=2.1 ms --- 192.168.100.1 hping statistic --- 1 packets tramitted, 1 packets received, 0% packet loss round-trip min/avg/max = 2.1/2.1/2.1 ms
Port 81/tcp seems to be closed as we receive a RST/ACK.
Scan mode
$ sudo hping -I wlan0 -S --scan 20,21,22,80,8080 -V 192.168.100.1 using wlan0, addr: 192.168.100.18, MTU: 1500 Scanning 192.168.100.1 (192.168.100.1), port 20,21,22,80,8080 5 ports to scan, use -V to see all the replies +----+-----------+---------+---+-----+-----+ |port| serv name | flags |ttl| id | win | +----+-----------+---------+---+-----+-----+ 20 ftp-data : ..R.A... 64 0 0 21 ftp : ..R.A... 64 0 0 22 ssh : .S..A... 64 0 5840 80 www : .S..A... 64 0 5840 8080 http-alt : .S..A... 64 0 5840 All replies received. Done. Not responding ports: