IPv6 from scratch - the very basics of IPv6

 

The basics of IPv6, IPv6 addresses, IPv6 scopes - kind of IPv6 for dummies. 😉

Links:

• https://www.youtube.com/watch?v=oItwDXraK1M
• IPv6 cheat sheet
  

THC-IPv6 – Toolkit Attacking the IPV6 Protocol

A complete tool set to attack the inherent protocol weaknesses of IPV6 and ICMP6, and includes an easy to use packet factory library. Please note to get full access to all the available tools you need to develop IPV6 tools yourself or submit patches, tools and feedback to the thc-ipv6 project.

The tools:

• parasite6: icmp neighbor solitication/advertisement spoofer, puts you as man-in-the-middle, same as ARP mitm (and parasite)
• alive6: an effective alive scanng, which will detect all systems listening to this address
• dnsdict6: parallized dns ipv6 dictionary bruteforcer
• fake_router6: announce yourself as a router on the network, with the highest priority
• redir6: redirect traffic to you intelligently (man-in-the-middle) with a clever icmp6 redirect spoofer
• toobig6: mtu decreaser with the same intelligence as redir6
• detect-new-ip6: detect new ip6 devices which join the network, you can run a script to automatically scan these systems etc.
• dos-new-ip6: detect new ip6 devices and tell them that their chosen IP collides on the network (DOS).
• trace6: very fast traceroute6 with supports ICMP6 echo request and TCP-SYN
• flood_router6: flood a target with random router advertisements
• flood_advertise6: flood a target with random neighbor advertisements
• fuzz_ip6: fuzzer for ipv6
• implementation6: performs various implementation checks on ipv6
• implementation6d: listen daemon for implementation6 to check behind a FW
• fake_mld6: announce yourself in a multicast group of your choice on the net
• fake_mipv6: steal a mobile IP to yours if IPSEC is not needed for authentication
• fake_advertiser6: announce yourself on the network
• smurf6: local smurfer
• rsmurf6: remote smurfer, known to work only against linux at the moment
• sendpees6: a tool by willdamn@gmail.com, which generates a neighbor solicitation requests with a lot of CGAs (crypto stuff  to keep the CPU busy. nice.

Limitations:

• Only support Linux 2.6.x (because of /proc usage)
• 32 Bit
• Ethernet and Raw are supported

Reference:

• more info & download

TCP/IP Headers

Very nice TCP/IP header drawing diagrams in both PDF and PNG formats. It has IPv4, IPv6, TCP, UDP, and ICMP.

Links:

• Header Drawings

Inside Uninformed Vol 10

Analyzing local privilege escalations in win32k

This paper analyzes three vulnerabilities that were found in win32k.sys that allow kernel-mode code execution. The win32k.sys driver is a major component of the GUI subsystem in the Windows operating system. These vulnerabilities have been reported by the author and patched in MS08-025.

The first vulnerability is a kernel pool overflow with an old communication mechanism called the Dynamic Data Exchange (DDE) protocol. The second vulnerability involves improper use of the ProbeForWrite function within string management functions. The third vulnerability concerns how win32k handles system menu functions. Their discovery and exploitation are covered.

Exploiting Tomorrow's Internet Today: Penetration Testing with IPv6

This paper illustrates how IPv6-enabled systems with link-local and auto-configured addresses can be compromised using existing security tools. While most of the techniques described can apply to "real" IPv6 networks, the focus of this paper is to target IPv6-enabled systems on the local network.

Crash Couse in IPv6

Two articles introducing IPv6.

http://www.windowsnetworking.com/articles_tutorials/Crash-Course-IPv6-Part1.html
http://www.windowsnetworking.com/articles_tutorials/Crash-Course-IPv6-Part2.html

It introduces the IPv6 address space and how it is represented normally and in HTTP URL.
Then it explains the significance of various bits in an IPv6 address; what is site-prefix, subnet-ID and interface-ID; unicast, multicast, and anycast.