1 IPv6 ICMP 2 icmp ipv6 request 3 4 i=IPv6() 5 i.dst="2001:db8:dead::1" 6 q=ICMPv6EchoRequest() 7 p=(i/q) 8 sr1(p)
9 ipv6 source route packets 10 i=IPv6() 11 i.dst="2001:db8:dead::1" 12 h=IPv6ExtHdrRouting() 13 h.addresses=["2001:db8:dead::1","2001:db8:dead::1","2001:db8:dead::1"] 14 p=ICMPv6EchoRequest() 15 pa=(i/h/p)
16 Routing Header Example 17 a = sr1(IPv6(dst="2001:4f8:4:7:2e0:81ff:fe52:9a6b")/ 18 IPv6ExtHdrRouting(addresses=["2001:78:1:32::1", "2001:20:82:203:fea5:385"])/ 19 ICMPv6EchoRequest(data=RandString(7)), verbose=0) 20 a.src
21 Traceroute 22 waypoint = "2001:301:0:8002:203:47ff:fea5:3085" 23 target = "2001:5f9:4:7:2e0:81ff:fe52:9a6b" 24 traceroute6(waypoint, minttl=15 ,maxttl=34,l4=IPv6ExtHdrRouting(addresses=[target])/ICMPv6EchoRequest(data=RandString(7)))
25 Current high score (not tested) 26 addr1 = "2001:4830:ff:12ea::2" 27 addr2 = "2001:360:1:10::2" 28 zz=time.time(); 29 a=sr1(IPv6(dst=addr2, hlim=255)/IPv6ExtHdrRouting(addresses=[addr1, addr2]*43)/ICMPv6EchoRequest(data="staythere"), verbose=0, timeout=80); 30 print "%.2f seconds" % (time.time() - zz)
31 ipv6 NA (version 1) 32 sendp(Ether()/IPv6()/ICMPv6ND_RA()/ ICMPv6NDOptPrefixInfo(prefix="2001:db8:cafe:deca::", prefixlen=64)/ ICMPv6NDOptSrcLLAddr(lladdr="00:b0:de:ad:be:ef"), loop=1, inter=3)
33 ipv6 NA (version 2) 34 a=IPv6(nh=58, src='fe80::214:f2ff:fe07:af0', dst='ff02::1', version=6L, hlim=255, plen=64, fl=0L, tc=224L) 35 b=ICMPv6ND_RA(code=0, chlim=64, H=0L, M=0L, O=0L, routerlifetime=1800, P=0L, retranstimer=0, prf=0L, res=0L, reachabletime=0, type=134) 36 c=ICMPv6NDOptSrcLLAddr(type=1, len=1, lladdr='00:14:f2:07:0a:f1') 37 d=ICMPv6NDOptMTU(res=0, type=5, len=1, mtu=1500) 38 e=ICMPv6NDOptPrefixInfo(A=1L, res2=0, res1=0L, L=1L, len=4, prefix='2001:db99:dead::', R=0L, validlifetime=2592000, prefixlen=64, preferredlifetime=604800, type=3) 39 send(a/b/c/d/e) 40 The one line Router Advertisement daemon killer 41 send(IPv6(src=server)/ICMPv6ND_RA(routerlifetime=0), loop=1, inter=1)
42 Test1 43 someaddr=["2001:6c8:6:4::7", "2001:500::1035", "2001:1ba0:0:4::1", 44 "2001:2f0:104:1:2e0:18ff:fea8:16f5", "2001:e40:100:207::2", 45 "2001:7f8:2:1::18", "2001:4f8:0:2::e", "2001:4f8:0:2::d"] 46 47 for addr in someaddr: 48 a = sr1(IPv6(dst=addr)/ICMPv6NIQueryName(data=addr), verbose=0) 49 print a.sprintf( "%-35s,src%: %data%")
50 Test2 51 someaddr=["2001:6c8:6:4::7", "2001:500::1035", "2001:1ba0:0:4::1", 52 "2001:2f0:104:1:2e0:18ff:fea8:16f5", "2001:e40:100:207::2", 53 "2001:7f8:2:1::18", "2001:4f8:0:2::e", "2001:4f8:0:2::d"] 54 55 for addr in someaddr: 56 a = sr1(IPv6(dst="ff02::1")/ICMPv6NIQueryName(data="ff02::1")) 57 print a.sprintf( "%data%") 58 59 IPv6 Scapy 3 Way 60 Creating a IPv6 3 Way Handshake 61 62 Step 1. 63 trun off the RST Packets from the Kernel, because no listen Port on the Source Port. (Scapy is not unsing RAW Socket) 64 iptables -A OUTPUT -p tcp --tcp-flags RST RST -d {dest IP} -j DROP
65 Step 2. 66 Send th SYN Packet with scapy and fetch the answer. 67 ip=IPv6(dst="2001:db8:0:1:207:3fff:fe68:df44") 68 TCP_SYN=TCP(sport=1500, dport=80, flags="S", seq=100) 69 TCP_SYNACK=sr1(ip/TCP_SYN)
70 Step 3. 71 Send the ACK Packet with scapy 72 my_ack = TCP_SYNACK.seq + 1 73 TCP_ACK=TCP(sport=1500, dport=80, flags="A", seq=101, ack=my_ack) 74 send(ip/TCP_ACK)
75 Step 4. 76 Check the client with netstat -na