Particularities of IPv6 networks
In this day and age, networks can no longer be scanned only on IPv4 networks. Many companies are gradually migrating to IPv6, and this has serious consequences for us as pentesters. Unlike IPv4, IPv6 addresses consist of 128 bits, whereby the first 64 bits (0-63) represent the interface identifier and the last 64 bits (64-127) the network. This results in 18 446 744 073 709 551 616 addresses in a /64-IPv6 network, which must be examined in a penetration test. (Try to say this number out loud.)
Even if we were to plan an entire year for a penetration test, we would have to scan about 584 billion IPs per second, as the following calculation demonstrates:
- 18 446 744 073 709 551 616 IPs / 365 days / 24 hours / 60 min / 60 sec
This means it’s impossible to check all addresses for even the availability of a single service during a pentest. Yet still, IPv6 does not provide realistic protection against an attacker, only a surmountable hurdle. As attackers, we are not the only ones scanning for IT systems in a network: the IT administrators also have to be able to manage their systems. Let’s take a look at the way IPv6 addresses are spelled out.
2ab0:a0b0:1:12:dead:0:b:1 is an example of an IPv6 address. As we can see, IPv6 addresses are divided into eight 16-bit blocks, among others, and indicated in hexadecimal digits. This allows for words like dead or beef to be chosen. Since administrators are only human after all, they will generally use a certain naming scheme. For example, if we already know the existing IPv6 addresses from the domain name resolution, we may be able to identify or guess a naming scheme.
In case of an internal penetration test, we have another technique for finding IPv6 addresses. By sending a multicast to all nodes via the command ping6 ff02::1%${interface}, we can identify IT systems in our local IPv6 network. However, only the target systems that accept ping requests will respond to our initial request. Furthermore, we will get link-local addresses in response to our command, which is why we need to specify the interface identifier behind the addresses in order to connect to our target systems. For example, an SSH connection request to an IPv6 link-local address would have the following syntax:
- ssh dwestcott@fe80::c48d:69ff:fe5f:8227%eth0
Pentest Training
Take a look at the pentest training chapters and learn penetration testing:
- Preface
- Introduction
- Legal Framework
- Hacking vs. Penetration Testing
- Classification
- Meaningfulness of Penetration Tests
- Penetration Testing Standards
- The Hacking Guide
- Hacking I: Scanning networks
- Hacking II: Password attacks
- Hacking III: Web application attacks
- Hacking IV: Privilege Escalation
- Hacking V: Tunnelling Techniques
- Hacking VI: Vulnerability scanner and penetration testing frameworks
- Demonstration of a Penetration Test
- Risk Assessment of Identified Vulnerabilities
- Structure of Documentation and Reporting
- Insider stories: Tales from Dubius Payment Ltd.
binsec academy GmbH – Advanced Pentest Training Lab
binsec academy GmbH operates the Pentest Training Lab, a highly practical online platform dedicated to real penetration testing. Simulating complex corporate networks and advanced real-world attack scenarios within isolated lab environments, it is engineered to sharpen the skills of aspiring and professional penetration testers. Upon conquering our rigorous, fully practical examination, participants earn the distinguished Binsec Academy Certified Pentest Professional (BACPP) designation — proving their technical capability to methodically uncover and evaluate vulnerabilities in modern IT infrastructures.
Explore the Pentest Training Lab
binsec GmbH – Experts in Penetration Testing
As the operative pentesting core of the binsec group, binsec GmbH has provided high-end, human-led penetration testing since 2013. Rejecting automated scans, our permanently employed, certified senior pentest experts deliver manual deep-dive assessments of web applications, APIs, mobile apps, complex network infrastructures, cloud environments, and advanced red team simulations. Specializing in high-regulation sectors like Payment, Banking, and Healthcare, we provide clear risk evaluations and actionable reports to effectively assess your business-critical systems.
Get Manual Expert Penetration Testing Services