Hping Tips and Tricks

Hping is a TCP/IP packet forging tool with embedded Tcl scripting functionality. Developed by antirez in 1998, it is now in its 3rd release. The tool runs on all major operatings systems including Linux, *BSD, and Windows.

Port Scanning

Hping gives you complete freedom to craft any raw IP, TCP, UDP, and ICMP packets.

With such powerful capability we can proceed to replicate most of the standard scan types:

TCP SYN Scan

The simplest way to initiate a classic TCP SYN Scan is to use the following command line options:

hping3 -S 72.14.207.99 -p 80 -c 1

NOTE: I had to use -c 1 flag in order to send the SYN packet only once, otherwise hping will continue sending probes.

This will produce the following output:

HPING 72.14.207.99 (eth1 72.14.207.99): S set, 40 headers + 0 data bytes
len=46 ip=72.14.207.99 ttl=244 id=64932 sport=80 flags=SA seq=0 win=8190 rtt=266.4 ms

--- 72.14.207.99 hping statistic ---
1 packets transmitted, 1 packets received, 0% packet loss
round-trip min/avg/max = 266.4/266.4/266.4 ms

This will scan port 80 on Google. As we can see from the output returned packet from Google contains SYN and ACK flags set which indicates an open port.

In order to scan a range of ports starting from port 80 and up use the following command line:

hping3 -S 4.2.2.1 -p ++50