Hping2 Basics.pdf

(20 KB) Pobierz
The Ethical Hacker Network
Tutorial: Hping2 Basics
del.icio.us
Discuss in Forums {mos_smf_discuss:Gates}
By Chris Gates, CISSP, CPTS, CEH
The classic ping command has served the IT community well. But with the never ending escalation of security and the
blocking of most ICMP traffic at both the border as well as the host, the plain old ping command is no longer enough to
accomplish even the simplest of network administrative tasks. This is exactly where a handy tool named hping2 comes
into the fold to lift the capabilities of ping to heights it never imagined.
For a specific definition of what exactly hping2 is, here is an excerpt from http://www.hping.org:
Hping2 is a command-line oriented TCP/IP packet assembler/analyzer. The interface is inspired by the ping(8) Unix
command, but hping isn't only able to send ICMP echo requests. It supports TCP, UDP, ICMP and RAW-IP protocols,
has a traceroute mode, the ability to send files between a covert channel, and many other features. All header fields can
be modified and controlled using the command line. A good understanding of IP and TCP/UDP is mandatory to use and
understand the utility. While hping2 was mainly used as a security tool in the past, it can be used in many ways. Below is
a subset of the stuff you can do using hping2:
Firewall testing
Advanced port scanning
http://www.ethicalhacker.net
Powered by Joomla!
Generated: 4 October, 2008, 14:40
The Ethical Hacker Network
Network testing, using different protocols, TOS, fragmentation
Manual path MTU discovery
Advanced traceroute, under all the supported protocols
Remote OS fingerprinting
Remote uptime guessing
TCP/IP stacks auditing
hping can also be useful to students that are learning TCP/IP.
-----------For a more detailed description and to download the binaries, visit http://www.hping.org. You can obtain a full
working version of hping2 on a bootable CD (among other tools) at http://www.knoppix-std.org or on BackTrack.
While hping2 can do all of that, we will start by learning how hping2 can manipulate and craft packets for the testing of
remote systems. We are going to start out easy and send different types of TCP packets with different flags set.
http://www.ethicalhacker.net
Powered by Joomla!
Generated: 4 October, 2008, 14:40
The Ethical Hacker Network
Hping2 is relatively easy to install on any *nix system. Go to the website and download it or use wget. Once it’s
downloaded you can issue the configure, make & make install commands to compile and install the program. Once
it’s installed you will see that hping2 has a ton of options. You can see them by issuing the man hping2 or hping2
–help command. I won’t promise we’ll go through them all but we are going to try.
Using Hping2 to Craft TCP Packets
Crafting TCP packets is the default behavior of Hping. By specifying the TCP flags, a destination port and a target IP
address, one can easily construct TCP packets.
-F --fin set FIN flag
-S --syn set SYN flag
-R --rst set RST flag
-P --push set PUSH flag
-A --ack set ACK flag
-U --urg set URG flag
-X --xmas set X unused flag (0x40)
-Y --ymas set Y unused flag (0x80)
Before we start throwing packets all over your lab network, you should be aware that when you do not specify a
destination port on the targeted computer it will default to 0. Also if you do not specify a source port it will use a random
ephemeral port and go up numerically from there. P.S. I am going to use TCPDUMP to view the output of the hping2
packets/scans. If it’s a bunch of nonsense to you, I recommend you learn TCPDUMP basics (use Google).
-S (SYN) Packet
The first packet we are going to send is the –S Syn packet. The attacker computer is 192.168.0.105 and the
computer we are attacking is 192.168.0.100.
Hping2 INPUT:
http://www.ethicalhacker.net
Powered by Joomla!
Generated: 4 October, 2008, 14:40
The Ethical Hacker Network
[root@localhost hping2-rc3]# hping2 -S 192.168.0.100
HPING 192.168.0.100 (eth0 192.168.0.100): S set, 40 headers + 0 data bytes
len=46 ip=192.168.0.100 ttl=128 id=18414 sport=0 flags=RA seq=0 win=0 rtt=149.9 ms
len=46 ip=192.168.0.100 ttl=128 id=18416 sport=0 flags=RA seq=1 win=0 rtt=0.5 ms
len=46 ip=192.168.0.100 ttl=128 id=18417 sport=0 flags=RA seq=2 win=0 rtt=0.4 ms
len=46 ip=192.168.0.100 ttl=128 id=18418 sport=0 flags=RA seq=3 win=0 rtt=0.5 ms
len=46 ip=192.168.0.100 ttl=128 id=18420 sport=0 flags=RA seq=4 win=0 rtt=1.6 ms
--- 192.168.0.100 hping statistic ---
5 packets tramitted, 5 packets received, 0% packet loss
round-trip min/avg/max = 0.4/30.6/149.9 ms
[root@localhost hping2-rc3]#
TCPDUMP OUTPUT:
[root@localhost root]# tcpdump tcp -X -s 1514
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 1514 bytes
14:19:22.506194 IP 192.168.0.105.2690 > 192.168.0.100.0: S 729051484:729051484(0) win 512
0x0000: 4500 0028 f5e2 0000 4006 02d0 c0a8 0069 E..(....@......i
0x0010: c0a8 0064 0a82 0000 2b74 715c 00ee aed9 ...d....+tq\....
0x0020: 5002 0200 d4aa 0000
P.......
14:19:23.649879 IP 192.168.0.105.2691 > 192.168.0.100.0: S 1045497134:1045497134(0) win 512
0x0000: 4500 0028 09bb 0000 4006 eef7 c0a8 0069 E..(....@......i
0x0010: c0a8 0064 0a83 0000 3e51 052e 34a4 7513 ...d....>Q..4.u.
0x0020: 5002 0200 340b 0000
P...4...
14:19:24.649886 IP 192.168.0.105.2692 > 192.168.0.100.0: S 734408221:734408221(0) win 512
0x0000: 4500 0028 79cb 0000 4006 7ee7 c0a8 0069 E..(y...@.~....i
0x0010: c0a8 0064 0a84 0000 2bc6 2e1d 1432 0224 ...d....+....2.$
0x0020: 5002 0200 b107 0000
P.......
-----SNIP---------
http://www.ethicalhacker.net
Powered by Joomla!
Generated: 4 October, 2008, 14:40
The Ethical Hacker Network
10 packets captured
10 packets received by filter
0 packets dropped by kernel
[root@localhost root]#
As you can see in blue, hping2 picked an arbitrary port, in this case 2690, and incremented by one each time. In orange
is the target port of 0 on the remote system which stays 0 since we did not specify a destination port. We can tell that is a
SYN packet by seeing the S in red. Additionally, I received ACKs back from the 192.168.0.100 machine but edited those
out here. That explains why in the hping2 output I sent 5 packets and received 5 packets. They were ACKs to my SYN
packets.
Sending a SYN packet by the initiating system is the first step in the TCP/IP 3 way handshake. The next step is for the
replying computer to send back a SYN/ACK packet, and finally an ACK packet to complete the handshake process.
The SYN (Steath) Scan is one of the most common scans used by port scanners. When the scan was initially being used
it was considered stealthy because connections were not logged if they did not complete the 3 way handshake process.
This has sense been long remedied and most common Intrusion Detection Systems will alert on SYN Scans.
-R (RST) Packet
The next packet we are going to send is the –R Reset (RST) packet. The reset packet is used to reset a
connection. As you can see the command syntax is very similar. The only change is in the actual switch itself. Instead of -
S it is -R.
"The RST packet is often used to perform what is known as inverse mapping. What this means is that RST packets are
sent out and the response received is what will tell you if the host exists or not. If you send out a RST scan you would get
one of two things. You will either get no response which indicates to you that the host is probably alive or you’ll
receive an ICMP host unreachable message. This would indicate that the host does not exist. This is what is known as
inverse mapping. Some IDS systems will not log RST packets/scans due to the sheer multitude of them. This is why the
inverse scan is popular." [1]
Hping2 INPUT:
[root@localhost hping2-rc3]# hping2 -R 192.168.0.100
HPING 192.168.0.100 (eth0 192.168.0.100): R set, 40 headers + 0 data bytes
http://www.ethicalhacker.net
Powered by Joomla!
Generated: 4 October, 2008, 14:40

Plik z chomika:

Inne pliki z tego folderu:

Inne foldery tego chomika:

Zgłoś jeśli naruszono regulamin