{% hint style="success" %}
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
Support HackTricks
- Check the subscription plans!
- Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.
- Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.
IPv6 addresses are structured to enhance network organization and device interaction. An IPv6 address is divided into:
- Network Prefix: The initial 48 bits, determining the network segment.
- Subnet ID: Following 16 bits, used for defining specific subnets within the network.
- Interface Identifier: The concluding 64 bits, uniquely identifying a device within the subnet.
While IPv6 omits the ARP protocol found in IPv4, it introduces ICMPv6 with two primary messages:
- Neighbor Solicitation (NS): Multicast messages for address resolution.
- Neighbor Advertisement (NA): Unicast responses to NS or spontaneous announcements.
IPv6 also incorporates special address types:
- Loopback Address (
::1
): Equivalent to IPv4's127.0.0.1
, for internal communication within the host. - Link-Local Addresses (
FE80::/10
): For local network activities, not for internet routing. Devices on the same local network can discover each other using this range.
To interact with IPv6 networks, you can use various commands:
- Ping Link-Local Addresses: Check the presence of local devices using
ping6
. - Neighbor Discovery: Use
ip neigh
to view devices discovered at the link layer. - alive6: An alternative tool for discovering devices on the same network.
Below are some command examples:
ping6 –I eth0 -c 5 ff02::1 > /dev/null 2>&1
ip neigh | grep ^fe80
# Alternatively, use alive6 for neighbor discovery
alive6 eth0
IPv6 addresses can be derived from a device's MAC address for local communication. Here's a simplified guide on how to derive the Link-local IPv6 address from a known MAC address, and a brief overview of IPv6 address types and methods to discover IPv6 addresses within a network.
Given a MAC address 12:34:56:78:9a:bc
, you can construct the Link-local IPv6 address as follows:
- Convert MAC to IPv6 format:
1234:5678:9abc
- Prepend
fe80::
and insertfffe
in the middle:fe80::1234:56ff:fe78:9abc
- Invert the seventh bit from the left, changing
1234
to1034
:fe80::1034:56ff:fe78:9abc
- Unique Local Address (ULA): For local communications, not meant for public internet routing. Prefix:
FEC00::/7
- Multicast Address: For one-to-many communication. Delivered to all interfaces in the multicast group. Prefix:
FF00::/8
- Anycast Address: For one-to-nearest communication. Sent to the closest interface as per routing protocol. Part of the
2000::/3
global unicast range.
- fe80::/10: Link-Local addresses (similar to 169.254.x.x)
- fc00::/7: Unique Local-Unicast (similar to private IPv4 ranges like 10.x.x.x, 172.16.x.x, 192.168.x.x)
- 2000::/3: Global Unicast
- ff02::1: Multicast All Nodes
- ff02::2: Multicast Router Nodes
- Obtain the MAC address of a device within the network.
- Derive the Link-local IPv6 address from the MAC address.
- Send a ping to the multicast address
ff02::1
to discover IPv6 addresses on the local network.
service ufw stop # Stop the firewall
ping6 -I <IFACE> ff02::1 # Send a ping to multicast address
ip -6 neigh # Display the neighbor table
Several techniques exist for executing MitM attacks in IPv6 networks, such as:
- Spoofing ICMPv6 neighbor or router advertisements.
- Using ICMPv6 redirect or "Packet Too Big" messages to manipulate routing.
- Attacking mobile IPv6 (usually requires IPSec to be disabled).
- Setting up a rogue DHCPv6 server.
A method to find subdomains that are potentially linked to IPv6 addresses involves leveraging search engines. For instance, employing a query pattern like ipv6.*
can be effective. Specifically, the following search command can be used in Google:
site:ipv6./
To identify IPv6 addresses, certain DNS record types can be queried:
- AXFR: Requests a complete zone transfer, potentially uncovering a wide range of DNS records.
- AAAA: Directly seeks out IPv6 addresses.
- ANY: A broad query that returns all available DNS records.
After pinpointing IPv6 addresses associated with an organization, the ping6
utility can be used for probing. This tool helps in assessing the responsiveness of identified IPv6 addresses, and might also assist in discovering adjacent IPv6 devices.
- http://www.firewall.cx/networking-topics/protocols/877-ipv6-subnetting-how-to-subnet-ipv6.html
- https://www.sans.org/reading-room/whitepapers/detection/complete-guide-ipv6-attack-defense-33904
{% hint style="success" %}
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
Support HackTricks
- Check the subscription plans!
- Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.
- Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.