TCP Flood & IP Spoofing Tutorial - Hping3 (With Effective Tricks)

hping

is a command-line oriented TCP/IP packet assembler/analyzer. Using hping3 you are able to perform at least the following stuff:

• Test firewall rules
• Testing Network performance using different protocols, packet size, TOS (type of service) and fragmentation
• Remote OS fingerprinting.
• TCP/IP stack auditing

Today, we will use hping3 for testing network performance. In other words we will use it to do DDOS Attack Tests. We can start “Help Document” by typing “hping3 --help” on the command line.

Hping3

Important Parameters : 

The flood parameter : Activates the fastest packet sending mode

The destport(p) parameter : Specifies the destination port

The spoof(a) parameter : Specifies which IP Adress is to be spoofed

The rand-source parameter : Activates the random source address mode

Although the above parameters are important, it should be selected which flag is set to determine the main attack type. 

Main Attack Types : 

The syn(S) parameter: Specifies that the SYN flag is set

The ack(A) parameter : Specifies that the ACK flag is set

The fin(F) parameter : Specifies that the FIN flag is set

The rst(R) parameter : Specifies that the RESET flag is set

The push(P) parameter : Specifies that the PUSH flag is set
The urg(U) parameter : Specifies that the URGENT flag is set
Hping3 will not show any output on the screen when running in flood mode. However, it continues to work on background. First, perform the SYN Flood attack. IP spoofing is not required for a basic DDoS attack.

SYN Flood Syntax Example:

hping3 --flood -p DST_PORT VICTIM_IP -S

SYN Flood Attack - Hping3

During the test, 1 million packets were sent within a very short period of time. In the image below, you can see that system resources have been allocated for incoming packages to the target system (System resources are allocated for 120 seconds).

Target Computer - SYN Flood Attack

This attack is not as effective as expected. The reason for this is that the system resources are released in less than 120 seconds. Operating systems send SYN+ACK packets in response to SYN packets. Hping3 produces the packages to send independently of the operating systems. And operating systems send SYN+ACK packets in response to SYN packets. If TCP/IP bases are examined, it seems that no SYN+ACK packet is sent except for 3-Way Handshake. In this case, however, the attacker's operating system responding to the SYN+ACK packet will terminate the communication by sending a RESET packet to the target system because there is no SYN packet previously sent by the attacker's operating system. As a result, the space allocated to the target system resources is released in less than 120 seconds.
An inactive IP address on the network must be spoofed to make an effective attack. In this case there will not be an operating system that can send RESET packets :)

SYN Flood Syntax Example 2:

hping3 --flood -p DST_PORT VICTIM_IP -S --spoof INACTIVE_IP

IP Spoofing - Hping3 

When an inactive IP address is spoofed, CPU utilization on the target system has increased from 42 percent to 76 percent.

Target Computer - IP Spoofed SYN Flood Attack

If you think that everything is just that, try to make TCP packets look like they come from different sources. We use Hping3's Random Source(rand-source) parameter to create TCP packets that appear to come from millions of different IP Addresses.

SYN Flood Syntax Example 3:

hping3 --flood -p DST_PORT VICTIM_IP -S --rand-source

Random Source - Hping3

When Random IP addresses are spoofed, CPU utilization on the target system has increased from 76 percent to 85 percent.

Target Computer - Random Source SYN Flood Attack

As you can see in the image above, if you use the Random Source feature, all packets on the target system appear to come from different IP addresses.
Although they are not as effective as the SYN flood attack, you can see how the ACK Flood and FIN Flood attack types are used with Hping3 in the examples below.

ACK Flood Syntax Example:

hping3 --flood -p DST_PORT VICTIM_IP -A

ACK Flood Attack - Hping3

FIN Flood Syntax Example:

hping3 --flood -p DST_PORT VICTIM_IP -A

FIN Flood Attack - Hping3