Pentesting IPv6
Last updated
Last updated
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
IPv6 addresses are structured to enhance network organization and device interaction. An IPv6 address is divided into:
Network Prefix: The initial 48 bits, determining the network segment.
Subnet ID: Following 16 bits, used for defining specific subnets within the network.
Interface Identifier: The concluding 64 bits, uniquely identifying a device within the subnet.
While IPv6 omits the ARP protocol found in IPv4, it introduces ICMPv6 with two primary messages:
Neighbor Solicitation (NS): Multicast messages for address resolution.
Neighbor Advertisement (NA): Unicast responses to NS or spontaneous announcements.
IPv6 also incorporates special address types:
Loopback Address (::1): Equivalent to IPv4's 127.0.0.1, for internal communication within the host.
Link-Local Addresses (FE80::/10): For local network activities, not for internet routing. Devices on the same local network can discover each other using this range.
To interact with IPv6 networks, you can use various commands:
Ping Link-Local Addresses: Check the presence of local devices using ping6.
Neighbor Discovery: Use ip neigh to view devices discovered at the link layer.
alive6: An alternative tool for discovering devices on the same network.
Below are some command examples:
IPv6 addresses can be derived from a device's MAC address for local communication. Here's a simplified guide on how to derive the Link-local IPv6 address from a known MAC address, and a brief overview of IPv6 address types and methods to discover IPv6 addresses within a network.
Given a MAC address 12:34:56:78:9a:bc, you can construct the Link-local IPv6 address as follows:
Convert MAC to IPv6 format: 1234:5678:9abc
Prepend fe80:: and insert fffe in the middle: fe80::1234:56ff:fe78:9abc
Invert the seventh bit from the left, changing 1234 to 1034: fe80::1034:56ff:fe78:9abc
Unique Local Address (ULA): For local communications, not meant for public internet routing. Prefix: FEC00::/7
Multicast Address: For one-to-many communication. Delivered to all interfaces in the multicast group. Prefix: FF00::/8
Anycast Address: For one-to-nearest communication. Sent to the closest interface as per routing protocol. Part of the 2000::/3 global unicast range.
fe80::/10: Link-Local addresses (similar to 169.254.x.x)
fc00::/7: Unique Local-Unicast (similar to private IPv4 ranges like 10.x.x.x, 172.16.x.x, 192.168.x.x)
2000::/3: Global Unicast
ff02::1: Multicast All Nodes
ff02::2: Multicast Router Nodes
Obtain the MAC address of a device within the network.
Derive the Link-local IPv6 address from the MAC address.
Send a ping to the multicast address ff02::1 to discover IPv6 addresses on the local network.
Several techniques exist for executing MitM attacks in IPv6 networks, such as:
Spoofing ICMPv6 neighbor or router advertisements.
Using ICMPv6 redirect or "Packet Too Big" messages to manipulate routing.
Attacking mobile IPv6 (usually requires IPSec to be disabled).
Setting up a rogue DHCPv6 server.
A method to find subdomains that are potentially linked to IPv6 addresses involves leveraging search engines. For instance, employing a query pattern like ipv6.* can be effective. Specifically, the following search command can be used in Google:
To identify IPv6 addresses, certain DNS record types can be queried:
AXFR: Requests a complete zone transfer, potentially uncovering a wide range of DNS records.
AAAA: Directly seeks out IPv6 addresses.
ANY: A broad query that returns all available DNS records.
After pinpointing IPv6 addresses associated with an organization, the ping6 utility can be used for probing. This tool helps in assessing the responsiveness of identified IPv6 addresses, and might also assist in discovering adjacent IPv6 devices.
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
