Pentesting IPv6 enabled systems is the same as pentesting systems running IPv4, except where it’s not Seriously: taking a closer look it turns out that quite some IPv6 enabled/dual-stacked systems have vulnerabilities that their IPv4-only counterparts do not expose.
This talk covers how to spot those weak points. We’ll mainly focus on three areas:
– specifics of IPv6 (e.g. Extension Headers) which allow to circumvent security controls commonly used in the IPv4 world like stateless ACLs on network devices.
– typical cases where the protection coverage is different for IPv4 and IPv6, e.g. due to lack of maturity of the respective defensive tools, or simply because the security responsible operators were not aware of extra work needed for IPv6.
– how to handle situations where a particular attack path involves IPv4-only technology but you still want to perform it against an IPv6 target.
Of course, we will also discuss which attack tools – there’s a variety of them in the interim – to use specifically for which of the above scenarios, to get results in the most efficient way. The talk will include a number of demos and examples from real-life.