IPv6 Local Neighbor Discovery Using Router Advertisement
Send a spoofed router advertisement with high priority to force hosts to start the IPv6 address auto-config. Monitor for IPv6 host advertisements, and try to guess the link-local address by concatinating the prefix, and the host portion of the IPv6 address. Use NDP host solicitation to determine if the IP address is valid'
Rank
- Normal
Authors
- wuntee < >
Vulnerability References
Development
Similar Modules
- auxiliary/scanner/discovery/arp_sweep
- auxiliary/scanner/discovery/ipv6_multicast_ping
- auxiliary/scanner/discovery/ipv6_neighbor
- auxiliary/scanner/discovery/udp_probe
- auxiliary/scanner/discovery/udp_sweep
Usage Information
$ msfconsole
## ### ## ##
## ## #### ###### #### ##### ##### ## #### ######
####### ## ## ## ## ## ## ## ## ## ## ### ##
####### ###### ## ##### #### ## ## ## ## ## ## ##
## # ## ## ## ## ## ## ##### ## ## ## ## ##
## ## #### ### ##### ##### ## #### #### #### ###
##
msf > use auxiliary/scanner/discovery/ipv6_neighbor_router_advertisement
msf auxiliary(ipv6_neighbor_router_advertisement) > run
## ### ## ##
## ## #### ###### #### ##### ##### ## #### ######
####### ## ## ## ## ## ## ## ## ## ## ### ##
####### ###### ## ##### #### ## ## ## ## ## ## ##
## # ## ## ## ## ## ## ##### ## ## ## ## ##
## ## #### ### ##### ##### ## #### #### #### ###
##
msf > use auxiliary/scanner/discovery/ipv6_neighbor_router_advertisement
msf auxiliary(ipv6_neighbor_router_advertisement) > run
Module Options
| INTERFACE | The name of the interface |
| SHOST | The source IPv6 address |
| SMAC | The source MAC address |
| TIMEOUT | Timeout when waiting for host response. (default: 5) |
| TIMEOUT_NEIGHBOR | Time (seconds) to listen for a solicitation response. (default: 1) |
| GATEWAY | The gateway IP address. This will be used rather than a random remote address for the UDP probe, if set. |
| NETMASK | The local network mask. This is used to decide if an address is in the local network. |
| PREFIX | Prefix that each host should get an IPv6 address from |
| UDP_SECRET | The 32-bit cookie for UDP probe requests. |
| VERBOSE | Enable detailed status messages |
| WORKSPACE | Specify the workspace for this module |
