skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

exploiting-ipv6-vulnerabilities

Tests IPv6-specific attack paths including SLAAC spoofing, rogue Router Advertisements, and tunneling during authorized assessments.

954|172|Updated Mar 13, 2026
Search Tags:#penetration testing#network security#IPv6#NTLM relay#mitm6#router advertisement#slaac
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill exploiting-ipv6-vulnerabilities
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: exploiting-ipv6-vulnerabilities
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/network-security/exploiting-ipv6-vulnerabilities
Command: npx skills add https://github.com/xalgord/xalgorix --skill exploiting-ipv6-vulnerabilities

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires scapy, mitm6, thc-ipv6, impacket, nmap.

What problem does it solve?

Dual-stack networks often enforce strict IPv4 controls while leaving IPv6 completely unmanaged, letting attackers perform man-in-the-middle attacks and credential relay without exploiting any traditional vulnerability. This Skill provides a structured workflow to enumerate, exploit, and document IPv6 weaknesses during authorized penetration tests.

Core Features & Use Cases

  • IPv6 Discovery and Enumeration: Identify IPv6-enabled hosts, Router Advertisements, and DHCPv6 services using alive6, Nmap multicast scripts, and tcpdump.
  • SLAAC/DHCPv6 MITM Attacks: Use mitm6 with ntlmrelayx to become the IPv6 DNS server for Windows hosts and relay WPAD-triggered NTLM credentials.
  • RA Guard Evasion and Tunnel Detection: Test RA Guard bypass via fragmented Router Advertisements and detect 6to4, Teredo, and ISATAP tunnels that bypass IPv4-only firewalls.
  • Use Case: On an internal assessment of an IPv4-only enterprise VLAN, run mitm6 to capture DNS traffic from Windows workstations, relay NTLM authentication to the domain controller, and document how missing RA Guard and empty ip6tables rules enabled domain compromise.

Quick Start

Ask the AI to enumerate IPv6 hosts on the authorized target VLAN and test whether mitm6 can take over DNS for Windows workstations.

Frequently Asked Questions about exploiting-ipv6-vulnerabilities

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I perform an IPv6 man-in-the-middle attack with mitm6?▼

Run mitm6 with the target domain and interface to send Router Advertisements and answer DHCPv6 requests, becoming the IPv6 DNS server for Windows hosts. Combine it with impacket-ntlmrelayx over IPv6 to relay WPAD-triggered NTLM credentials to target servers.

How to test if RA Guard can be bypassed on a switch?▼

Send a Router Advertisement hidden behind an IPv6 fragment header or crafted extension-header chain, for example with thc-ipv6 fake_router26 using the -E option. Many switches that filter plain RAs miss fragmented ones, so test evasion before declaring RA Guard effective.

Does mitm6 work against Linux or macOS hosts?▼

No, mitm6 relies on Windows issuing a DHCPv6 Solicit after seeing a Router Advertisement. SLAAC-only Linux and macOS hosts ignore it, so an empty mitm6 console does not prove the network is safe.

Can IPv6 attacks work on a network that only uses IPv4?▼

Yes, because Windows hosts have IPv6 enabled by default with link-local addresses and answer NDP even without an IPv6 router. You can enumerate them with nmap -6 multicast scripts and exploit DHCPv6 to take over DNS.

Why does mitm6 show no victims during an assessment?▼

Common causes are non-Windows targets, DHCPv6 traffic not reaching victims, or not waiting long enough for the Windows DHCPv6 cycle, which can take minutes or require a relogin. Confirm victim OS, network reachability, and timing before concluding the network is not vulnerable.

When should IPv6 exploitation testing not be performed?▼

Do not run it on production networks without written authorization, on systems where IPv6 disruption could cause safety issues, or as denial-of-service against network infrastructure. RA flooding can destabilize devices and IPv6-dependent services like SCCM.

Related Skills

Explore More Software Engineering Skills→
bingookbingook

network-protocol-attacks

Execute layer 2/3 network protocol attacks including ARP spoofing and DNS spoofing.

Community
Advanced
ArianHobson333ArianHobson333
7

credential-access

Extract credentials via LSASS dumping, SAM/SECURITY hives, and DPAPI decryption.

Community
Advanced
wgpsecwgpsec
1.7k

mapcidr-cidr

Expand, aggregate, slice, and shuffle CIDR ranges and IP lists with mapcidr.

Official
Basic
bingookbingook

ntlm-relay-coercion

Relay NTLM authentication to SMB, LDAP, HTTP, or MSSQL targets.

Community
Advanced