Narrator: Hping. 2 2
In the last several videos, we have spent time talking a lot 3 3
about Nmap because it's a really important tool. 4 4
In the rest of this section, we're going to cover a lot 5 5
of other little reconnaissance tools that we can use 6 6
as part of our enumeration. 7 7
Now, most of these videos are going to be fairly short 8 8
but I just want to give you the idea 9 9
of what these different tools are. 10 10
So if you identify them on your network, you understand 11 11
that a lot of times these are being used 12 12
as attack tools against you to do a footprinting 13 13
and fingerprinting of your network. 14 14
The first one I want to talk about here is hping. 15 15
Now, hping is used to do packet crafting and manipulation 16 16
and this is often used by attackers. 17 17
Now, hping is an open source spoofing tool 18 18
that provides a pentester 19 19
with the ability to craft their own network packets 20 20
to exploit vulnerable firewalls 21 21
and intrusion detection and intrusion prevention systems. 22 22
The idea with hping is to do a lot 23 23
of different functions for you. 24 24
You can do things like host import detection 25 25
and firewall testing. 26 26
You can do timestamping, you can use traceroute, 27 27
you can do fragmentation, or you can even do denial 28 28
of services and use it as an attack tool. 29 29
We're going to talk about each of those in this section. 30 30
First host import detection and firewall testing. 31 31
This is one of the functions of hping. 32 32
Just like we could craft things with Nmap 33 33
in the way we use SYN or ACK packets to do our detection, 34 34
we can do the same thing with hping. 35 35
So if I wanted to use hping here, 36 36
I can type it in something like this. 37 37
Hping3-S-p80-c1 1 92.168.1.1. 38 38
Now, what is this command telling hping to do? 39 39
It's saying send a SYN packet. 40 40
That's the dash S over port 80, 41 41
which is the port I want to target with a count of one 42 42
meaning send only one SYN packet to this IP address. 43 43
So this is going to be very stealthy 44 44
because I'm only sending one packet out 45 45
and trying to get a response to see if you're awake. 46 46
This will allow me to enumerate your network very quietly 47 47
and very stealthily 48 48
against a single IP address just shown here. 49 49
Now, the next thing we can do is we can use something 50 50
like -A. 51 51
Now with hping3- A and the rest of it's all the same, 52 52
I'm going to use an acknowledgement packet 53 53
instead of a SYN packet 54 54
so I can send whatever kind of packet I want. 55 55
I can choose using hping 56 56
because I'm manipulating and crafting this packet 57 57
that I'm going to send across the network. 58 58
Both of these are ways to help you avoid detection 59 59
via firewall or IDs or ips. 60 60
Next, we can also do timestamping using hping. 61 61
This allows to determine the system's uptime. 62 62
How long has that host been online? 63 63
Now, if you look at a workstation, 64 64
they generally have reboot it every night, 65 65
but servers they may be up for a long, long time. 66 66
The other thing that uptime tells you is 67 67
if you have a server that's been up for say a year, 68 68
that means they probably haven't installed 69 69
all the patches or upgrades 70 70
because usually you have to reboot a server 71 71
when you put in those larger patches and upgrades. 72 72
So timestamping is useful for that. 73 73
To send this type of a packet, 74 74
you would use hping3-c2 or c1, 75 75
in this case c2-s p80--tcp-timestamp 76 76
and then the IP address. 77 77
So in this case I'm sending two SYN packets 78 78
over port 80 to determine the uptime of that system. 79 79
Now, the reason I'm sending two packets 80 80
here is it's usually going to be a little bit more effective 81 81
to send two when you're doing a timestamp 82 82
than just doing one. 83 83
Next we're going to use traceroute. 84 84
Now, traceroute is going to use arbitrary packet formats 85 85
such as probing DNS ports using TCP or UDP 86 86
to be able to perform traces when you can't use ICMP 87 87
in a given network because it's blocked. 88 88
As I said back when we talked about Nmap, 89 89
traceroute and ping can often be blocked by firewalls 90 90
because they're not going to allow echo reply packets 91 91
which use ICMP to go out of the network. 92 92
So you can start using different packet formats 93 93
like SYN packets and acknowledged packets 94 94
to be able to do that traceroute for you. 95 95
Next one we want to talk about is fragmentation. 96 96
Now, fragmentation attempts to evade detection by the IDs 97 97
and IPS and firewalls by sending fragmented packets 98 98
across the network for later reassembly. 99 99
Because we're using TCP, I can send the packets 100 100
in any order I want and fragment it, and the system, 101 101
once it receives them all, we'll put them back together. 102 102
In older days, you could actually send fragments 103 103
through so that detection wouldn't be caught. 104 104
In most modern operating systems, 105 105
they are going to get caught 106 106
even if you're using fragmentation. 107 107
Now, the next one we're going to talk about 108 108
and the last one we're going to talk 109 109
about is denial of service or DoS. 110 110
This can be used to perform flood based denial 111 111
of service attacks from randomized source IPs. 112 112
Additionally, you can actually craft that packet 113 113
any way you want. 114 114
So if you think back to your security+, 115 115
you talked about things like the ping of death. 116 116
Well, if you're doing the ping of death, 117 117
you took a packet and you made a really, 118 118
really large size packet that was over the size 119 119
of a ping packet that's allowed, which is 65,535 bites. 120 120
And so if you had one that was larger than that, 121 121
it could actually corrupt a system and make it crash. 122 122
These days, most systems are not vulnerable 123 123
to a ping of death, so you're not going to be able 124 124
to do denial of service that way. 125 125
But using hping was a valid way to do it 126 126
because you could craft the packet 127 127
and make it whatever size you wanted. 128 128
Now, again, I want to bring up the point 129 129
that fragmentation and denial of service 130 130
while they are used in hping, 131 131
they're not going to be something 132 132
that's going to be very effective in today's environment 133 133
because most modern operating systems 134 134
and network appliances know these attacks occur 135 135
and so they don't allow fragmentation to occur 136 136
to be able to sneak things through. 137 137
They'll reassemble the packets first and then scan them 138 138
against the IDS or the denial of service, 139 139
those things will be blocked 140 140
because they know they're coming. 141 141
Now, if you're going against some kind of a legacy system 142 142
or some kind of a skater or ICS or embedded system 143 143
some of those attacks may still work using fragmentation 144 144
or denial of service. 145 145
So it is still something that's valid to try 146 146
as a penetration tester. 147 147
But again, for the most case, 148 148
most of our modern OSs are going to be invulnerable 149 149
to this type of an attack.