Differences for page Hping2 Win32 Version -- hping network security tool

hping wiki

Differences for page Hping2 Win32 Version

Current version compared with version Sun Mar 09 17:52:21 GMT 2008

...
  
  {\[09/03/2008\] \<paul\>} 
  Hi! I see only one MD5 reference on this page:
- warwick 27sept2004: md5 of hping2.1-rc2-win32.zip as of this date is: d8dc42f9a03d578b27d08076cbfd89da 
+ "`{warwick 27sept2004:} md5 of hping2.1-rc2-win32.zip as of this date is: d8dc42f9a03d578b27d08076cbfd89da`" 
  However, when I DL the above file, I get a different checksum (e679e74b0f940c7d675cde856c65070b). I tried downloading twice, with the same results.
  I see above a reference to sectools on SourceForge; should I be downloading that instead? (no sign of an MD5 there, either, btw). Looks like there has been no further development on this for a while... Any plans to port version 3?

The following is the old page content

The source for the Win32 Version and the .exe for the [Win32] version are attached to this page. 
To run, [WinPCap] and [Cygwin]1.dll are also necessary.  They can be downloaded at their respective sites. 
----
===hping2-rc2 native Win32 version===-->kacke

Hope I'm not intruding, but I figured I ought to post this here.  I've been working on a native Windows version of hping (doesn't require Cygwin), and this can be found at the bottom of this page {hping2-rc3-win32.zip}.

There's source code and an executable in the zip file.  Make sure to read the info. about a few changes I made in regards to hping command line arguments.  Any feedback would be great.  Thanks.

[antirez] 7Jul2004: Thanks, I think this is the way to go for the hping on win32. With hping3 the idea is to create a layer to abstract the input/output
operations and just use the right one selecting it at compile time (i.e. via ifdefs).

[buzvolio] 11aug2004: Thanks for this win32 version ...
Just a question : what is the problem with the "-E --file" option in the hping2-rc2-win32 version ? I tested it and i only see xxxxxxx in the data ! (With the linux hping the data appear normally ...) Somebody can confirm that ?

{rgturpin} 22aug2004: I've uploaded the Win32 version to this site ({hping2-rc2-win32.zip}).  My website no longer exists.  I also went through and fixed a few things, so this is a more current version.  In regards to '--file' problem above.  Could you send me an example of what you tried to do?  Then I could look into it.  Also, if anyone has any questions my e-mail is {rgturpin@epop3.com}.

{rgturpin} 28aug2004: Updated some files and recompiled, new version is posted here.  There were some problems with sending data from a file.  This should be fixed.

{warwick} 27sept2004: anyway you can post MD5\SHA1 hashes with the updated files?  With everyone able to UL files it sorta makes them somewhat suspect...okay  ALOT suspect.

{antirez} 27sept2004: I may implement a way to upload `trusted` files here. Like a password I'll send only to people that like
rgturpin are uploading useful files here. The upload will still be free for all, but files uploaded with the trusted
files will be colorized in a different way and marked as trusted.

{warwick} 27sept2004: md5 of hping2.1-rc2-win32.zip as of this date is: d8dc42f9a03d578b27d08076cbfd89da

{nobody you know} 1oct2004:  How exactly does this make the file more trusted? Couldn't I, or anyone else, edit this
page, and change the md5 sum to reflect a trojaned file?  Maybe with a pgp signature or something there could be trust.
Or am I missing something - it's entirely possible I am...

{antirez} 01Oct2004: actually even putting the md5 can be enough, but *very* impratical. It's btw possible because in this wiki all can add files, but
only the original uploader can remove they (and I of course). Instead the md5 can be manipulated, but this wiki has full history, so if I write
the file 12345.tar.gz has md5sum of XYZ, a motivated reader may check in the history what's the *first* claim of the md5sum, that's the real one
because every modification creates a new entry in the history. Btw, it's ways too complex, and it's better to provide a special password
to uploaders so that the wiki will show that a file is trusted in a special way, and as long as the password is in the hands of good people
there are no problems.

{jsavage} 16 Nov2004:  Could someone please clarify whether this implementation of hping has the problem with TCP checksum that has been apparently fixed with hping2 RC3 ?

{jsavage} 16 Nov 2004:  Attempting to set the checksum to 1212 using "hping --icmp-cksum 1212 10.0.0.13" doesn't work.  Whereas using "hping -b 10.0.0.13" to set a bad checksum works correctly and errors are clearly identified by ethereal on target system.  Is this a problem with my syntax or an anomoly with the utility?

{rgturpin} 17 Nov 2004:  Sorry about that.  Added the current cksum.c and re-compiled.

{rgturpin} 3 Dec 2004:  Implemented scan mode, so mostly this is up to date to hping2-rc3 Unix version.  One issue, scanning for known ports like `hping --scan known <hostname>` wasn't implemented.  I'll get to it later, but I wanted to get this version with scan mode working and uploaded.

And now the fun stuff.  The new SP2 for Windows XP appears to be causing some issues.  Here's a link explaining some changes to raw sockets.

[link http://www.microsoft.com/technet/prodtechnol/winxppro/maintain/sp2netwk.mspx#EHAA]

Some people have reported some problems with Windows XP SP2.  TCP packets don't get sent out (10004 error).  UDP and ICMP appear to be fine.  (However, you cannot spoof an IP with UDP packets).  I'd like to get more feedback from other people on how it is working on Windows XP SP2 machines.

I am experiencing the 10004 Error on a WinXPSP2 machine with Firewall disabled. FYI

{me} 21 Dec 2004:  To regain raw sockets under Windows XP SP2, you must give up the dandy-new firewall they created.  Turn off the Windows Firewall and Internet Connection Sharing service (right click on My Computer, select Manage, select Services, scroll down to find the service, stop it, and set to Disabled under the Properties).
{dzenizo} 20 Jun 2005: This doesn't seem to work. Maybe win32 hping needs to be recoded like nmap contributors did as explained at http://seclists.org/lists/nmap-hackers/2004/Jul-Sep/0003.html

{unknown} Hi all, when will be the hping 3, windows port will be available.

{sstalib@yahoo.com 7th March 2005}

Do I have to install the whole CYGWIN to get the cygwin1.dll?? Or can I just copy it to my system32 directory. Thanks.

guys it is becoming tuff to install this veriosn , some help please

{jsavage} 15 Jun 2005:  Have just spotted the reply to my 16 Nov 2004 entry re "hping --icmp-cksum 1212 10.0.0.13" I have downloaded rc3 and this still doesn't work in that all checksums received are correct.  Whereas using "hping -b 10.0.0.13" creates incorrect checksums.
Have I got the syntax correct?  Can anyone else confirm this as a problem ?  Thanks.

(DF) Sry, Who use Hping2 in Windown XP can post here some example ? I can't use it on my computer

{Smartoez 2nd sep 2005} When I run Hping2 in windows sp2 with winpcap and cygwin installed, it gives the error: [pcap_get_if_name] failed, and error: [main] no such devices. Can anybody help me in this aspect please.

xaros2000(Reply to Smartoez):I really doubt if HPing is gonna work in XP SP2,as Microsoft removed raw socket support in this platform.Try XP SP 1.As for the [pcap_get_if_name] error you're getting,use WinPcap 3.1-Beta 4:the latest 3.1 final broke compatibility with older binaries not only of HPing,but also with many other tools.

{Newbie 5th Oct 2005}: I downloaded latest hping, latest WinPcap (3.1), and even patched the EventID 4226 thing (patched tcpip.sys). With my WinXP SP2 & Windows Firewall/Internet Connection Sharing (ICS) Stopped/Disabled, I still CANNOT send TCP packets and get *[send_ip] sendto: 10004* message. What else can I do please? I really need help and want to have my WinXP SP2 machine working......

{k!} whats the difference between the .zip file an the .exe file at the bottom of this page. i assume, that the .zip file can run without cygwin1.dll - is it right? nevertheless i am not able to run any of those programms on winxp sp2 - so if anybody knows how to avoid "sendto: 10004" or "sendto: No Error" (funny message by the way, because there is no NO Error) PLEASE let me know!!! thx ... bye

{Reply to k!, 12th Oct 2005}: WinXP SP2 isn't friendly to Hping (Read Newbie's post on 10/5/05). I needed to grab an old WinXP SP1 (WinXP w/o SP, or W2k should also work) and install to the 2nd partition of my HDD, then it worked with Hping this time.

{SPSS, 28th Oct 2005}: I don't get any response from the target with hping2 for whatever i do. It is behaving like it should behave in quiet mode with option -Q.

{\[21st Dec 2005\] \<definate\>} You should get a SourceForge account. Excellent work. Can't wait until it rivals the nix version.
----
{\[29th May 2006\] \<secureideas\>} We think we have fixed hping2 to use with SP2.  We have uploaded the program below as hping2.win32.tar.gz.  As soon as someone removes the older versions we will also upload the exe by itself.  Winzip will open the tar.gz file.

The upload function is not working.  Will see who can fix that.

{\[31th May 2006\] \<braymond\>} Thanks for updating it to support SP2. If you don't mind could you post it somewhere until the upload function is addressed? If you don't have any place to post it I can offer my site at http://www.attemptatsanity.com

{\[14th June 2006\] \<leoneri\>} Hello, is the fixed ver. for SP2 already uploaded to braymond's site? I check http://www.attemptatsanity.com and didn't found any.. or maybe I missed it somewhere... thx.

{\[20th June 2006\] \<zipk0der\>} I have repackaged the executable with the dlls needed from winpcap, in case you don't want to install that (Packet.dll, wpcap.dll, & WanPacket.dll), and uploaded it all to my website here: http://www.pandora-security.com/forum/viewtopic.php?p=5212#5212
Let me know what you think.

{\[23rd 2006\] \<secureideas\>} We have put the fixed version onto a sourceforge site.  It is available at http://sourceforge.net/projects/sectools
It is available as a download and within the CVS system there.  Feel free to submit bugs or comments on that site.

{\[24th June 2006\] \<zipk0der\>} I've updated my mirrored package accordingly. A thank you to the developers for making this tool available to Windows users. Find it here: http://www.pandora-security.com/forum/viewtopic.php?p=5212#5212

{\[30th June 2006\] \<Tim\>} I read -help and still can't get it run. Can somebody post some examples? thx

{\[27th July 2006\] \<unknown\>} I get this when I run it on Windows 2000 (route_get()). Any idea???

{\[26/09/2006\] \<maxmon\>} I get the same problem �route_get()�. I run WinXP SP2 (build 2600.xpsp_sp2_gdr.050301-1519) Wireshark (version 0.99.3) and WinPcap (version 3.1.0.27). Any idea? Anyone who can reproduce the problem? thx!

(\[01/07/2006] I'm using the latest version downloaded of SourceForge, and I have SP2 installed. Hping say me: [main] no such devide. Anyone can help me?

jserink2004@yahoo.com Hi All. Just to let you know, I downloaded the hping2.win32.tar.gz file and the Win32 binary did not work on my local subnet, I keep getting the route_get() errors. I think downloaded the hping2-rc3.win32.zip file at the bottom of this page and the binary in that one works fine. I'm on XP Pro, SP2, Windoze FW off. Note that both Binaries list out like this:
F:\downloads\SoftwareandManuals\SecurityTesting\Hping>hping --version
hping version 2.0.0-rc3 (Mon May  3 10:56:19 CEST 2004)
libpcap based binary

So I'm not sure what the difference is between the two except that the one from the zip file below works, the other one does not. :) John

james.v.fields@gmail.com - There is a new version of Hping2 for Win32 being uploaded shortly to the sourceforge site (project name: sectools).  It contains fixes missing from our last release that should help with some of the remaining problems, specifically the route_get() errors and the continued send_ip errors when going up against hosts in the local subnet.  It does NOT attempt to add functionality or fix things that never worked in the Win32 release, i.e. the --force-icmp function has not ever worked in the Windows release and still doesn't.

{\[17/02/2008\] \<maxx\>} hi, same problem:
with common verion (2): route_get()route_get() ...

with rc3 version: HPING \[...\] NO FLAGS are set, 40 headers + 0 data bytes

\[send_ip\] sendto: 10004

BUT: there are no packets on the other side of the LAN (captured with tcpdump)

solutions??

{\[09/03/2008\] \<paul\>} 
Hi! I see only one MD5 reference on this page:
warwick 27sept2004: md5 of hping2.1-rc2-win32.zip as of this date is: d8dc42f9a03d578b27d08076cbfd89da 
However, when I DL the above file, I get a different checksum (e679e74b0f940c7d675cde856c65070b). I tried downloading twice, with the same results.
I see above a reference to sectools on SourceForge; should I be downloading that instead? (no sign of an MD5 there, either, btw). Looks like there has been no further development on this for a while... Any plans to port version 3?