1 1 00:00:00,360 --> 00:00:02,130 Hping. 2 2 00:00:02,130 --> 00:00:05,460 In the last several videos, we have spent time talking a lot 3 3 00:00:05,460 --> 00:00:08,280 about Nmap because it's a really important tool. 4 4 00:00:08,280 --> 00:00:10,440 In the rest of this section, we're going to cover a lot 5 5 00:00:10,440 --> 00:00:12,540 of other little reconnaissance tools that we can use 6 6 00:00:12,540 --> 00:00:14,340 as part of our enumeration. 7 7 00:00:14,340 --> 00:00:16,530 Now, most of these videos are going to be fairly short 8 8 00:00:16,530 --> 00:00:17,640 but I just want to give you the idea 9 9 00:00:17,640 --> 00:00:19,140 of what these different tools are. 10 10 00:00:19,140 --> 00:00:21,840 So if you identify them on your network, you understand 11 11 00:00:21,840 --> 00:00:23,580 that a lot of times these are being used 12 12 00:00:23,580 --> 00:00:26,250 as attack tools against you to do a footprinting 13 13 00:00:26,250 --> 00:00:28,230 and fingerprinting of your network. 14 14 00:00:28,230 --> 00:00:30,900 The first one I want to talk about here is hping. 15 15 00:00:30,900 --> 00:00:34,230 Now, hping is used to do packet crafting and manipulation 16 16 00:00:34,230 --> 00:00:36,330 and this is often used by attackers. 17 17 00:00:36,330 --> 00:00:38,820 Now, hping is an open source spoofing tool 18 18 00:00:38,820 --> 00:00:39,960 that provides a pentester 19 19 00:00:39,960 --> 00:00:42,750 with the ability to craft their own network packets 20 20 00:00:42,750 --> 00:00:44,370 to exploit vulnerable firewalls 21 21 00:00:44,370 --> 00:00:47,460 and intrusion detection and intrusion prevention systems. 22 22 00:00:47,460 --> 00:00:49,380 The idea with hping is to do a lot 23 23 00:00:49,380 --> 00:00:50,880 of different functions for you. 24 24 00:00:50,880 --> 00:00:52,950 You can do things like host import detection 25 25 00:00:52,950 --> 00:00:54,300 and firewall testing. 26 26 00:00:54,300 --> 00:00:57,180 You can do timestamping, you can use traceroute, 27 27 00:00:57,180 --> 00:00:59,790 you can do fragmentation, or you can even do denial 28 28 00:00:59,790 --> 00:01:02,010 of services and use it as an attack tool. 29 29 00:01:02,010 --> 00:01:04,230 We're going to talk about each of those in this section. 30 30 00:01:04,230 --> 00:01:07,620 First host import detection and firewall testing. 31 31 00:01:07,620 --> 00:01:09,630 This is one of the functions of hping. 32 32 00:01:09,630 --> 00:01:11,970 Just like we could craft things with Nmap 33 33 00:01:11,970 --> 00:01:15,150 in the way we use SYN or ACK packets to do our detection, 34 34 00:01:15,150 --> 00:01:17,160 we can do the same thing with hping. 35 35 00:01:17,160 --> 00:01:18,750 So if I wanted to use hping here, 36 36 00:01:18,750 --> 00:01:20,490 I can type it in something like this. 37 37 00:01:20,490 --> 00:01:25,490 Hping3-S-p80-c1 1 92.168.1.1. 38 38 00:01:28,110 --> 00:01:30,570 Now, what is this command telling hping to do? 39 39 00:01:30,570 --> 00:01:32,580 It's saying send a SYN packet. 40 40 00:01:32,580 --> 00:01:35,340 That's the dash S over port 80, 41 41 00:01:35,340 --> 00:01:38,250 which is the port I want to target with a count of one 42 42 00:01:38,250 --> 00:01:41,520 meaning send only one SYN packet to this IP address. 43 43 00:01:41,520 --> 00:01:42,840 So this is going to be very stealthy 44 44 00:01:42,840 --> 00:01:44,790 because I'm only sending one packet out 45 45 00:01:44,790 --> 00:01:47,460 and trying to get a response to see if you're awake. 46 46 00:01:47,460 --> 00:01:50,160 This will allow me to enumerate your network very quietly 47 47 00:01:50,160 --> 00:01:51,330 and very stealthily 48 48 00:01:51,330 --> 00:01:54,390 against a single IP address just shown here. 49 49 00:01:54,390 --> 00:01:56,760 Now, the next thing we can do is we can use something 50 50 00:01:56,760 --> 00:01:58,230 like -A. 51 51 00:01:58,230 --> 00:02:02,010 Now with hping3- A and the rest of it's all the same, 52 52 00:02:02,010 --> 00:02:03,900 I'm going to use an acknowledgement packet 53 53 00:02:03,900 --> 00:02:05,520 instead of a SYN packet 54 54 00:02:05,520 --> 00:02:07,620 so I can send whatever kind of packet I want. 55 55 00:02:07,620 --> 00:02:09,240 I can choose using hping 56 56 00:02:09,240 --> 00:02:11,970 because I'm manipulating and crafting this packet 57 57 00:02:11,970 --> 00:02:13,830 that I'm going to send across the network. 58 58 00:02:13,830 --> 00:02:16,050 Both of these are ways to help you avoid detection 59 59 00:02:16,050 --> 00:02:18,810 via firewall or IDs or ips. 60 60 00:02:18,810 --> 00:02:21,660 Next, we can also do timestamping using hping. 61 61 00:02:21,660 --> 00:02:23,850 This allows to determine the system's uptime. 62 62 00:02:23,850 --> 00:02:26,220 How long has that host been online? 63 63 00:02:26,220 --> 00:02:27,450 Now, if you look at a workstation, 64 64 00:02:27,450 --> 00:02:29,100 they generally have reboot it every night, 65 65 00:02:29,100 --> 00:02:32,490 but servers they may be up for a long, long time. 66 66 00:02:32,490 --> 00:02:33,750 The other thing that uptime tells you is 67 67 00:02:33,750 --> 00:02:36,210 if you have a server that's been up for say a year, 68 68 00:02:36,210 --> 00:02:37,740 that means they probably haven't installed 69 69 00:02:37,740 --> 00:02:38,940 all the patches or upgrades 70 70 00:02:38,940 --> 00:02:40,980 because usually you have to reboot a server 71 71 00:02:40,980 --> 00:02:43,260 when you put in those larger patches and upgrades. 72 72 00:02:43,260 --> 00:02:45,360 So timestamping is useful for that. 73 73 00:02:45,360 --> 00:02:46,860 To send this type of a packet, 74 74 00:02:46,860 --> 00:02:50,400 you would use hping3-c2 or c1, 75 75 00:02:50,400 --> 00:02:54,960 in this case c2-s p80--tcp-timestamp 76 76 00:02:56,790 --> 00:02:58,200 and then the IP address. 77 77 00:02:58,200 --> 00:03:00,810 So in this case I'm sending two SYN packets 78 78 00:03:00,810 --> 00:03:04,140 over port 80 to determine the uptime of that system. 79 79 00:03:04,140 --> 00:03:05,460 Now, the reason I'm sending two packets 80 80 00:03:05,460 --> 00:03:07,410 here is it's usually going to be a little bit more effective 81 81 00:03:07,410 --> 00:03:08,970 to send two when you're doing a timestamp 82 82 00:03:08,970 --> 00:03:09,993 than just doing one. 83 83 00:03:10,860 --> 00:03:13,260 Next we're going to use traceroute. 84 84 00:03:13,260 --> 00:03:16,080 Now, traceroute is going to use arbitrary packet formats 85 85 00:03:16,080 --> 00:03:19,230 such as probing DNS ports using TCP or UDP 86 86 00:03:19,230 --> 00:03:22,170 to be able to perform traces when you can't use ICMP 87 87 00:03:22,170 --> 00:03:24,360 in a given network because it's blocked. 88 88 00:03:24,360 --> 00:03:25,783 As I said back when we talked about Nmap, 89 89 00:03:25,783 --> 00:03:28,860 traceroute and ping can often be blocked by firewalls 90 90 00:03:28,860 --> 00:03:31,140 because they're not going to allow echo reply packets 91 91 00:03:31,140 --> 00:03:33,750 which use ICMP to go out of the network. 92 92 00:03:33,750 --> 00:03:36,600 So you can start using different packet formats 93 93 00:03:36,600 --> 00:03:38,700 like SYN packets and acknowledged packets 94 94 00:03:38,700 --> 00:03:41,340 to be able to do that traceroute for you. 95 95 00:03:41,340 --> 00:03:43,830 Next one we want to talk about is fragmentation. 96 96 00:03:43,830 --> 00:03:47,520 Now, fragmentation attempts to evade detection by the IDs 97 97 00:03:47,520 --> 00:03:50,430 and IPS and firewalls by sending fragmented packets 98 98 00:03:50,430 --> 00:03:52,920 across the network for later reassembly. 99 99 00:03:52,920 --> 00:03:55,350 Because we're using TCP, I can send the packets 100 100 00:03:55,350 --> 00:03:58,170 in any order I want and fragment it, and the system, 101 101 00:03:58,170 --> 00:04:00,900 once it receives them all, we'll put them back together. 102 102 00:04:00,900 --> 00:04:03,360 In older days, you could actually send fragments 103 103 00:04:03,360 --> 00:04:05,670 through so that detection wouldn't be caught. 104 104 00:04:05,670 --> 00:04:07,140 In most modern operating systems, 105 105 00:04:07,140 --> 00:04:08,340 they are going to get caught 106 106 00:04:08,340 --> 00:04:10,410 even if you're using fragmentation. 107 107 00:04:10,410 --> 00:04:11,940 Now, the next one we're going to talk about 108 108 00:04:11,940 --> 00:04:13,050 and the last one we're going to talk 109 109 00:04:13,050 --> 00:04:15,840 about is denial of service or DoS. 110 110 00:04:15,840 --> 00:04:17,850 This can be used to perform flood based denial 111 111 00:04:17,850 --> 00:04:20,670 of service attacks from randomized source IPs. 112 112 00:04:20,670 --> 00:04:23,070 Additionally, you can actually craft that packet 113 113 00:04:23,070 --> 00:04:24,150 any way you want. 114 114 00:04:24,150 --> 00:04:26,040 So if you think back to your security+, 115 115 00:04:26,040 --> 00:04:28,500 you talked about things like the ping of death. 116 116 00:04:28,500 --> 00:04:29,970 Well, if you're doing the ping of death, 117 117 00:04:29,970 --> 00:04:32,010 you took a packet and you made a really, 118 118 00:04:32,010 --> 00:04:34,800 really large size packet that was over the size 119 119 00:04:34,800 --> 00:04:39,000 of a ping packet that's allowed, which is 65,535 bites. 120 120 00:04:39,000 --> 00:04:40,470 And so if you had one that was larger than that, 121 121 00:04:40,470 --> 00:04:42,900 it could actually corrupt a system and make it crash. 122 122 00:04:42,900 --> 00:04:45,360 These days, most systems are not vulnerable 123 123 00:04:45,360 --> 00:04:46,710 to a ping of death, so you're not going to be able 124 124 00:04:46,710 --> 00:04:48,150 to do denial of service that way. 125 125 00:04:48,150 --> 00:04:50,280 But using hping was a valid way to do it 126 126 00:04:50,280 --> 00:04:51,510 because you could craft the packet 127 127 00:04:51,510 --> 00:04:53,580 and make it whatever size you wanted. 128 128 00:04:53,580 --> 00:04:55,410 Now, again, I want to bring up the point 129 129 00:04:55,410 --> 00:04:57,630 that fragmentation and denial of service 130 130 00:04:57,630 --> 00:04:59,850 while they are used in hping, 131 131 00:04:59,850 --> 00:05:00,780 they're not going to be something 132 132 00:05:00,780 --> 00:05:03,300 that's going to be very effective in today's environment 133 133 00:05:03,300 --> 00:05:04,950 because most modern operating systems 134 134 00:05:04,950 --> 00:05:07,560 and network appliances know these attacks occur 135 135 00:05:07,560 --> 00:05:10,110 and so they don't allow fragmentation to occur 136 136 00:05:10,110 --> 00:05:11,250 to be able to sneak things through. 137 137 00:05:11,250 --> 00:05:13,710 They'll reassemble the packets first and then scan them 138 138 00:05:13,710 --> 00:05:16,410 against the IDS or the denial of service, 139 139 00:05:16,410 --> 00:05:17,460 those things will be blocked 140 140 00:05:17,460 --> 00:05:19,260 because they know they're coming. 141 141 00:05:19,260 --> 00:05:21,960 Now, if you're going against some kind of a legacy system 142 142 00:05:21,960 --> 00:05:24,990 or some kind of a skater or ICS or embedded system 143 143 00:05:24,990 --> 00:05:27,900 some of those attacks may still work using fragmentation 144 144 00:05:27,900 --> 00:05:29,130 or denial of service. 145 145 00:05:29,130 --> 00:05:31,110 So it is still something that's valid to try 146 146 00:05:31,110 --> 00:05:32,610 as a penetration tester. 147 147 00:05:32,610 --> 00:05:34,440 But again, for the most case, 148 148 00:05:34,440 --> 00:05:36,900 most of our modern OSs are going to be invulnerable 149 149 00:05:36,900 --> 00:05:38,200 to this type of an attack.