Perimeter Testing

Perimeter testing means determining exactly what your firewall blocks and what it allows. To conduct a good test, you can spoof source IP addresses and source ports:

sudo hping3-a 10.0.44.45 -S james -c 2 -p 80

The result of the above command is that packets will appear to originate from the system at 10.0.44.45. Such a packet is useful for determining whether the firewall is allowing random packets in or out of your network.

In these cases, you don't have to use TCP. Using hping, you can generate UDP packets as well:

sudo hping3 targethost -c 2 --udp --baseport 80 --destport 80

The preceding command sends two UDP packets to port 80 on the target system from port 80 of your own system.

Of course, you can spoof the source IP address as well as the originating and destination ports:

sudo hping3 localhost -a 10.0.44.45 -c 2 --udp --baseport 80 --destport 80

Sending Files

Creating a tunnel is one way to find out what your firewall is capable of blocking. On your receiving system, issue the following command:

host$ sudo hping3 -i eth0 --listen signature --icmp

To send the contents of the file on your local system to a remote system named james, issue the following command:

user@host:~$ sudo hping3 -I eth0 localhost --icmp -d 100 --sign signature --file /etc/shadow

On your receiving system's terminal, you will see the output of the file you're sending (see Listing 4).

Notice that the contents of the file has been sent through the firewall. Also notice that I've decided to send the contents of a particularly sensitive file. Creating an ad-hoc tunnel in this way allows quick file transfer back and forth across a firewall. Furthermore, this feature is useful for testing exactly what a firewall is capable of blocking.

Simulating Attacks

The LAND attack [4], which first appeared in 1997, involves sending a spoofed packet with its SYN flag activated to a target host. This spoofed packet has the same source IP and source port as the target hosts's IP. When the attack first appeared, it caused unpatched Windows systems (and some Linux systems) to create an infinite connection loop and crash.

Many attackers exploited this bug to wage simple, sophomoric, and highly annoying denial of service attacks. More sophisticated users realized that such attacks were useful for hijacking attacks.

A new variation of the LAND attack turned up in 2005, and this classic technique could easily appear again.

Hping3 can help you ensure that your systems are immune to such an attack. Suppose you want to test a system with the IP address of 192.168.2.3 that has port 139 open. To do so, you would issue the following command:

sudo hping3 -S 192.168.2.3 -a 192.168.2.3 -k -s 139 -p 139 --flood

This attack could cause an unpatched target system to freeze. Also notice the --flood option, which sends thousands of packets to the system.