hping3

It performs network security auditing, Firewall testing, manual path MTU discovery, advanced Traceroute, remote OS fingerprinting, remote uptime guessing, TCP/IP stacks auditing, and other functions. It can send custom TCP/IP packets and display target replies similarly to a ping program with ICMP replies. It handles fragmentation as well as arbitrary packet body and size, and it can be used to transfer encapsulated files under the supported protocols. It also supports idle host scanning. IP spoofing and network/host scanning can be used to perform an anonymous probe for services. Hping3 also has a Traceroute mode, which enables attackers to send files between covert channels. It also determines whether the host is up even when the host blocks ICMP packets. Its firewalk-like usage allows the discovery of open ports behind firewalls. It performs manual path MTU discovery and enables attackers to perform remote OS fingerprinting.

ICMP Scan

hping3 -1 10.0.0.25

TCP SYN Scan

hping3 -8 50-60 –S 10.0.0.25 –V

FIN, PUSH, URG Scan

hping3 –F –P –U 10.0.0.25 –p 80

UDP Scan

hping3 -2 10.0.0.25 –p 80

ACK Scan

sudo hping3 --ack -p 80 10.10.1.11

Traceroute

hping3 --traceroute -V -S bcc-ca.gov.bd -p 443

Port Scan

hping3 -8 1-1000 -S 192.168.60.130 -V

Network scan

hping3 -1 10.0.1.x --rand-dest –I eth0

Intercept all traffic

hping3 -9 HTTP –I eth0

TCP Timestamping

Many firewalls drop those TCP packets that do not have the TCP Timestamp option set. By adding the --tcp-timestamp argument in the command line, you can enable the TCP timestamp option in Hping and try to guess the timestamp update frequency and uptime of the target host (72.14.207.99).

hping3 -S 72.14.207.99 -p 80 --tcp-timestamp

Collect sequence number

Using the argument -Q in the command line, Hping collects all the TCP sequence numbers generated by the target host (192.168.1.103). 

ping3 192.168.1.103 -Q -p 139

hping3 -A 192.168.60.130 -p 80 -c 5
Enter your search text in the box above

Select a result to preview