Page|1

Department of Software Engineering

Capital University of Science and Technology

Islamabad

Assignment #2
Penetration Testing

Submitted by:
M.Shakeeb-Khalid
Bse-193082

Submitted to:
Mr. Mehran Yousaf

Submission Date:
April 03, 2023
 Page|2

1. What is Hping tool, and what is it used for?

Hping is a command-line programme used for security audits, network discovery, and
fingerprinting. It enables network inspections and packet building of many kinds for security
experts. The adaptable tool hping supports a number of protocols, including TCP, UDP, ICMP,
and RAW-IP. The instrument can also be used to evaluate the effectiveness of networks and
intrusion detection systems.

2. List and explain the various scanning techniques available in Hping,

and provide an example for each.

a) SYN Scan:

SYN scan is a TCP-based scanning technique used to identify open ports on a target system.
This scan sends a SYN packet to the target system's ports, and if the port is open, the target will
respond with a SYN-ACK packet. Hping command for SYN scan is:

hping3 -S <target IP> -p <port>

Example: hping3 -S 192.168.0.1 -p 80

b) UDP Scan:

UDP scan is a scanning technique used to identify open UDP ports on a target system. Unlike
TCP, UDP does not establish a connection before transmitting data. Therefore, UDP scan sends
a UDP packet to the target system's ports and waits for a response. Hping command for UDP
scan is:

hping3 -2 <target IP> -p <port>

Example: hping3 -2 192.168.0.1 -p 53

c) FIN Scan:

FIN scan is a TCP-based scanning technique used to identify open ports on a target system. In
this scan, the FIN flag is sent to the target system's ports, and if the port is open, there will be no
response. Hping command for FIN scan is:

hping3 --fin <target IP> -p <port>

Example: hping3 --fin 192.168.0.1 -p 22

 Page|3

 Conduct a SYN scan on the target network, and explain the command
used.
To conduct a SYN scan on the target network using Hping tool, we will use the following
command:

hping3 -S <target IP> -p <port>

For example, if we want to conduct a SYN scan on the target system with IP 192.168.0.1 and
port 80, the command will be:

hping3 -S 192.168.0.1 -p 80

In this command, -S flag indicates that we want to perform a SYN scan, and -p flag indicates
the port number we want to scan. This command will send a SYN packet to port 80 of the target
system and wait for a response. If the port is open, the target system will respond with a SYN-
ACK packet.

 Conduct a UDP scan on the target network, and explain the command
used.
To conduct a UDP scan on the target network using Hping tool, we will use the following
command:

hping3 -2 <target IP> -p <port>

For example, if we want to conduct a UDP scan on the target system with IP 192.168.0.1 and
port 53, the command will be:

hping3 -2 192.168.0.1 -p 53

In this command, -2 flag indicates that we want to perform a UDP scan, and -p flag indicates
the port number we want to scan. This command will send a UDP packet to port 53 of the target
system and wait for a response. If the port is open, the target system will respond with a UDP

 To conduct a FIN scan using Hping tool, and explain the command
used:

hping3 --fin <target IP> -p <port>

For example, if we want to conduct a FIN scan on the target system with IP 192.168.0.1 and
port 22, the command will be:

hping3 --fin 192.168.0.1 -p 22

In this command, --fin flag indicates that we want to perform a FIN scan, and -p flag indicates
the port number we want to scan. This command will send a FIN packet to port 22 of the target
system and wait for a response. If the port is open, the target system will not respond with any
packet. However, if the port is closed, the target system will respond with a RST packet.
 Page|4

References:

Hping3 Official Website: http://www.hping.org/

Hping3 User Guide: http://www.hping.org/hping3-quickstart.txt

Nmap Network Scanning Book: https://nmap.org/book/

The Basics of TCP/IP: https://www.tcpipguide.com/free/t_toc.htm

Cybersecurity and Infrastructure Security Agency (CISA) - TCP/IP Ports and Protocols:
https://us-cert.cisa.gov/ncas/alerts/TA14-017A

SANS Institute - TCP Flags: https://www.sans.org/security-resources/tcpip/tcp-flags/