IPv6 attacks exploit weaknesses in IPv6-enabled networks, especially when administrators are unaware that IPv6 is active by default on modern systems. Even if an organization runs IPv4-only infrastructure, many hosts still support IPv6, making them vulnerable. Pentesters leverage IPv6 spoofing, rogue router advertisements, DHCPv6 attacks, and MITM techniques to intercept traffic, redirect flows, and capture credentials.

Why IPv6 Creates New Attack Opportunities

IPv6 introduces additional components that expand the attack surface:

Neighbor Discovery Protocol (NDP)
Router Advertisements (RA)
DHCPv6
SLAAC (Stateless Address Autoconfiguration)
Automatic address generation
Multicast-based communication

Because IPv6 traffic often goes unmonitored, attacks frequently succeed without detection.

Detecting IPv6 Availability

Before attacking, verify IPv6 activity on the network.

Checking IPv6 Traffic

sudo tcpdump -i eth0 ip6

Viewing IPv6 Interfaces

ip -6 addr

If systems have IPv6 addresses or send multicast packets, the network is vulnerable.

Rogue Router Advertisement (RA) Attacks

This is the most powerful IPv6 attack.
Routers advertise IPv6 settings to hosts. Any device can send RAs, and hosts accept them by default.

Launching Rogue RA with THC-IPv6

sudo fake_router6 eth0

This forces hosts to:

Use attacker as default gateway
Route all traffic through attacker
Prefer IPv6 over IPv4 (MITM success)

This is the IPv6 version of Rogue DHCP.

SLAAC-Based MITM Attacks

SLAAC allows hosts to auto-configure their IPv6 address using router advertisements.
A rogue RA forces hosts to configure using the attacker’s prefix.

SLAAC Attack

sudo fake_router6 -A eth0

Victims now use the attacker as gateway for outbound traffic.

DNS Spoofing via IPv6 RDNSS

IPv6 supports providing DNS servers through router advertisements (RDNSS option).

Injecting Malicious DNS

sudo fake_mipv6 -s 10.10.10.50 eth0

Victims will resolve DNS queries using the attacker’s DNS server.

DHCPv6 Rogue Server Attacks

If DHCPv6 is used, attackers can race legitimate servers to provide malicious configuration.

Launching Rogue DHCPv6

sudo dhcp6 -S eth0

This assigns:

Attacker DNS
Attacker gateway
Malicious IPv6 prefixes

NDP Spoofing (IPv6 ARP Spoofing Equivalent)

Neighbor Discovery replaces ARP in IPv6.
NDP spoofing redirects traffic similar to ARP poisoning.

Performing NDP Spoofing

sudo parasite6 eth0 <target_ip6> <attacker_mac>

This causes the target to send traffic to the attacker.

Detecting SLAAC and RA Vulnerabilities

Check which network devices accept IPv6 RAs.

Detecting RA Packets

sudo tcpdump -i eth0 'icmp6 && ip6[40] == 134'

If hosts accept RAs from any device, the network is insecure.

Flooding IPv6 Network Structures

THC-IPv6 includes tools to disrupt IPv6 networks.

Flooding Router Advertisements

sudo flood_router26 eth0

Flooding Neighbor Cache

sudo flood_solicitate6 eth0

These attacks cause denial of service and network instability.

IPv6 DNS Takeover (DNSv6 Spoofing)

Attackers can override DNS using rogue DHCPv6 or RA.

Setting Rogue DNS via Router Advertisement

sudo fake_router6 -R eth0

Victims resolve all domains using attacker DNS.

MITM Using IPv6 Preference Over IPv4

Systems prefer IPv6 when available.
Even if IPv4 is secured, IPv6 MITM succeeds because the attacker injects IPv6 routes.

Steps:

Inject malicious IPv6 RA
Victim switches to IPv6 gateway
All traffic flows through attacker
Intercept traffic and credentials

This works even when IPv4 is fully protected.

Why IPv6 Attacks Matter

IPv6 often exists silently in networks.
Attackers exploit this lack of visibility to:

Hijack traffic
Redirect DNS
Capture credentials
Conduct large-scale MITM
Perform DoS attacks
Bypass IPv4 security controls

IPv6 attacks easily bypass firewalls, NAC, and monitoring tools not configured for IPv6.

Intel Dump

IPv6 is active by default on most hosts
Rogue RAs and DHCPv6 attacks enable MITM
NDP spoofing is IPv6 ARP spoofing
Tools: THC-IPv6 suite (fake_router6, parasite6, dhcp6)
IPv6 bypasses many IPv4-only defensive systems