IPv6: attacks, detection & pentest techniques

IPv6 is the 128-bit successor to IPv4, designed to address exhaustion of the address space and introduce stateless auto-configuration via SLAAC. In cybersecurity, IPv6 represents a frequently overlooked attack surface. Many enterprise networks run dual-stack configurations where IPv6 is enabled but unmonitored. Attackers exploit this blind spot using techniques such as rogue Router Advertisement injection, which forces hosts to adopt a malicious default gateway at layer 3. Neighbor Discovery Protocol, the IPv6 replacement for ARP, introduces equivalent spoofing risks through Neighbor Advertisement poisoning. IPv6 also enables covert tunneling: protocols like Teredo, 6to4, and ISATAP encapsulate IPv6 traffic inside IPv4 UDP packets, bypassing perimeter firewalls that only inspect native IPv4 flows. Extension headers add further complexity, allowing attackers to fragment payloads or insert hop-by-hop options that evade shallow packet inspection. Understanding the IPv6 mechanics at this level is prerequisite for both offensive engagements and defensive hardening in modern network environments.

Detecting IPv6 abuse requires explicit monitoring coverage that most SOC teams do not enable by default. On Windows hosts, Event ID 4624 and 4625 may show logon attempts originating from IPv6 source addresses, which is an immediate indicator of lateral movement over an unmonitored stack. Network-level detection relies on capturing ICMPv6 traffic: unexpected Router Advertisement messages (ICMPv6 type 134) from non-infrastructure sources signal rogue RA injection. Tools such as NDPMon and RAmond parse live ICMPv6 streams and alert on unauthorized RA senders. In Zeek (formerly Bro), the conn.log and packet_filter.log fields expose dual-stack sessions that bypass IPv4-only SIEM rules. Suricata signatures targeting ICMPv6 type 135 and 136 (Neighbor Solicitation and Advertisement) can flag NDP spoofing attempts. For tunnel detection, analysts should inspect UDP port 3544 (Teredo) and protocol 41 (6in4) flows in NetFlow or IPFIX exports. Spike in these flow types from workstations, rather than routers, is a reliable anomaly indicator. Threat hunters should also query DNS logs for AAAA record lookups from hosts that have no legitimate IPv6 routing, revealing potential tunnel client activity.

Red team operators routinely weaponize IPv6 to bypass IPv4-centric defenses. The most impactful technique is rogue Router Advertisement injection using tools like fake_router6 from the THC-IPv6 toolkit or mitm6. The mitm6 tool specifically targets Windows hosts in Active Directory environments: it responds to DHCPv6 requests, assigns itself as the IPv6 default gateway and DNS server, then relays NTLM authentication to ntlmrelayx, achieving credential capture without any vulnerability in the target OS. This attack is effective even when IPv6 routing is disabled at the network level, because Windows still processes DHCPv6 by default. On the hardening side, deploying RA Guard on managed switches (IEEE 802.1aq-adjacent features available in Cisco, Juniper, and Aruba platforms) blocks unauthorized RA messages at the port level. DHCPv6 Guard similarly restricts DHCPv6 server responses to authorized ports. Disabling IPv6 via GPO on hosts that have no legitimate need reduces the attack surface significantly. For organizations that must maintain dual-stack, extending firewall ACLs, IDS rules, and SIEM parsing to cover IPv6 traffic explicitly is non-negotiable. Pentest reports should always document whether IPv6 was tested alongside IPv4.