mitm6

mitm6 enables attackers to perform man-in-the-middle attacks on IPv4 networks via IPv6. It targets Windows systems configured to prefer IPv6, allowing the tool to hijack DNS traffic by responding to DHCPv6 requests with fake IPv6 addresses and setting the attacker's host as the default DNS server.

Use cases include network penetration testing, red team engagements, and demonstrating IPv6-related misconfigurations in enterprise environments. The tool is particularly effective against networks where IPv6 is enabled but not properly secured.

It operates non-interactively once launched, continuously monitoring for DHCPv6 solicitations and responding accordingly to maintain control over victim DNS resolution.

mitm6 sends Router Advertisements (RAs) to advertise IPv6 presence, prompting Windows clients to send DHCPv6 solicitations. It replies with a DHCPv6 Advertise containing a link-local IPv6 address and designates the attacker's IP as the DNS server. Windows prioritizes this IPv6 DNS server, routing all DNS queries through the attacker. The tool then intercepts and can manipulate these queries for further exploitation like WPAD or NBT-NS poisoning.