• OTW

Using Hping3 for Reconnaissance, Part 1

One of the most time-consuming, but necessary, activities in hacking is reconnaissance. Before we can hack a system, we need to know what operating system it's running, what ports are open, what services are running, and hopefully, what applications are installed and running.



Due to its versatility, hping3 is often referred as a "packet crafting tool," which means that it can create just about any type of packet you can imagine. This can be very helpful in doing recon, as different packets will illicit different responses from the operating system TCP/IP stack, giving us clues to the underlying OS, ports, and services.

In addition, we can test various IDS and firewall evasion techniques such a fragmenting packets, slow scans, etc. There are so many things we can do with hping3, but I'll limit myself to just a few in this tutorial.

Like nearly all of the tools I demonstrate here in Hackers-Arise, hping3 is built into Kali . So, let's fire up our Kali and take a look at hping3.

Step 1: Finding hping3

hping3 is a powerful tool with numerous features and functions. We'll look at some of the basic functions that are applicable to hackers here, but investing a little time to learn additional features will be time well-invested.

Let's look at the help screen first.

kali > hping -h


As you can see, the help screen for hping3 is very long and detailed. To better view it, let's pipe it out to more.

kali >hping3 -h | more



  • -a switch enables us to spoof our IP address

  • --rand-dest produces packets with random destination ports

  • --rand-source produces packets with random addresses

  • -t sets the Time to Live (TTL) for the packets

  • -f fragments the packets



I want you to note the following switches;

  1. -Q shows only the sequence number

  2. -S scan using SYN packets

  3. --tcp-timestamp grabs the timestamp from the tcp packet

Also note that we can set any of the TCP flags (S,A,F,P, R, U) as well as the XMAS (-X)scan (flags P,U,F set).

Step 2: hping3 Default



kali > hping3 -S -p 80




kali > hping3 -S -p ++1




Step 3 Fragment Packets with hping3




Let's try the hping3 fragmentation scann against port 445 (SMB)

kali> hping3 -S -f -p 445


Step 4 Sending Data with hping3


Let's say we have a file named malware that contains an exploit we're trying to send to the target. In addition, we are concerned that this malware might be detected by the IDS. We could use the fragmentation switch and load the malware across multiple packets where it will be reassembled by the target, while evading the IDS or AV software.

kali > hping3 -f -p 80 -d 10 -E malware


  • -d is the data payload size (here, we've designated it as 10 bytes)

  • -E tells hping3 to grab data from the following file



Step 5: Predicting Sequence Numbers with hping3





kali > hping3 -Q -S google.com -p 80



-Q displays the sequence numbers


As you can see, google.com responds with its sequence numbers that hping3 captures and displays.

Step 6: hping3 for Uptime



Hping3 uses the tcp-timestamp field to predict how long the system has been up.

Let's try this against google.com.

kali > hping3 --tcp-timestamp -S google.com -p 80


As we can see, this google.com web server has been up just 9 days, 22 hours, 21 minutes, and 40 seconds. If you try this scan against other servers, you are likely to see much longer periods of time between the last reboot, sometimes measured in years. These, of course, would be prime targets!

Keep coming back my aspiring hackers as we continue our exploration of the most valuable skillset of the 21st century, hacking!

741 views0 comments