thc-ipv6: Is a suite of tools for attacking and auditing IPv6 networks

IPv6 gets rolled out in a lot of networks quietly, almost as an afterthought next to the “real” IPv4 network — and that’s exactly why it’s so often left unaudited and misconfigured. THC-IPv6, from The Hacker Choice, is the toolkit I reach for whenever I need to actually test how an IPv6 deployment behaves under adversarial conditions, rather than just assuming dual-stack means dual-secured.

What Is THC-IPv6?

THC-IPv6 is a suite of over 60 tools for attacking and auditing IPv6 and ICMPv6 networks, written by van Hauser and maintained by The Hacker Choice. It covers reconnaissance, denial-of-service, man-in-the-middle attacks, fuzzing, and protocol-level exploitation specific to IPv6’s neighbor discovery, router advertisement, and extension header mechanisms — attack surface that simply doesn’t exist in IPv4.

How THC-IPv6 Works Internally

• Neighbor Discovery Protocol (NDP) exploitation: IPv6 replaces ARP with NDP, which has no built-in authentication in most default deployments. Tools like parasite6 and fake_router6 exploit this by sending forged Neighbor Advertisement and Router Advertisement messages that other hosts on the segment trust implicitly.
• Router Advertisement abuse: IPv6 hosts commonly use SLAAC (Stateless Address Autoconfiguration), learning their network configuration — including default gateway — entirely from Router Advertisements on the local link. fake_router6 exploits this trust model directly to become the default gateway for a segment, enabling traffic interception.
• Extension header manipulation: Several tools (fragmentation6, firewall6) deliberately misuse IPv6’s extension header chain — a feature that doesn’t exist in IPv4 — to test how firewalls and IDS/IPS handle fragmented or unusually ordered headers, since many security appliances historically handled IPv6 extension headers poorly.
• DoS via resource exhaustion: Tools like ndpexhaust6 flood a target’s neighbor cache with bogus entries, exploiting the fact that many OS implementations allocate resources per NDP entry without adequate rate limiting.
• Naming convention: On Debian/Kali packages, every binary is prefixed atk6- (e.g., atk6-parasite6) to avoid filename collisions with other packages — worth knowing since most documentation online refers to the unprefixed names.

Installation

# Debian/Ubuntu/Kali
sudo apt update && sudo apt install thc-ipv6 -y

Verify and list installed binaries:

$ dpkg -L thc-ipv6 | grep bin/
/usr/bin/atk6-address6
/usr/bin/atk6-alive6
/usr/bin/atk6-detect_sniffer6
/usr/bin/atk6-dnsdict6
/usr/bin/atk6-fake_router6
/usr/bin/atk6-fragmentation6
/usr/bin/atk6-parasite6
/usr/bin/atk6-thcping6
/usr/bin/atk6-trace6
... (60+ tools total)

Key Tools and Verified Syntax

alive6 — IPv6 host discovery

$ atk6-alive6
Syntax: atk6-alive6 [-CFHLMPSdlpvV] [-I srcip6] [-i file] [-o file] [-e opt]
        [-s port,..] [-a port,..] [-u port,..] [-T tag] [-W TIME]
        interface [unicast-or-multicast-address [remote-router]]

Options:
  -i file    check systems from input file
  -o file    write results to output file
  -d         DNS resolve alive IPv6 addresses
  -M         enumerate hardware addresses (MAC) from input addresses (slow!)
  -C         enumerate common addresses of input networks, -CC for large scan
  -4 ipv4/range  test various IPv4 address encodings per network (eg 1.2.3.4/24)
  -p         send a ping packet for alive check (default)

Basic usage — discover all active IPv6 hosts on a local segment:

sudo atk6-alive6 eth0

address6 — IPv6 address analysis and conversion

$ atk6-address6
Syntax:
        atk6-address6 mac-address [ipv6-prefix]
        atk6-address6 ipv4-address [ipv6-prefix]
        atk6-address6 ipv6-address

Converts a mac or IPv4 address to an IPv6 address (link local if no prefix is
given as 2nd option) or, when given an IPv6 address, prints the mac or IPv4
address.

Example — derive the link-local address from a MAC:

atk6-address6 00:0c:29:aa:bb:cc

dnsdict6 — IPv6-aware DNS subdomain enumeration

$ atk6-dnsdict6
Syntax: atk6-dnsdict6 [-d4] [-s|-m|-l|-x|-u] [-t THREADS] [-D] domain [dictionary-file]

Enumerates a domain for DNS entries, it uses a dictionary file if supplied
or a built-in list otherwise.

Options:
 -4      do also dump IPv4 addresses
 -t NO   specify the number of threads to use (default: 8, max: 32).
 -D      dump the selected built-in wordlist, no scanning.
 -S      perform SRV service name guessing
 -[smlxu] choose the dictionary size by -s(mall=100), -m(edium=1419) (DEFAULT)

atk6-dnsdict6 -4 -t 16 example.com

thcping6 — crafted ICMPv6/TCP/UDP probing

$ atk6-thcping6
Syntax: atk6-thcping6 [-EafqxO] [-e ethertype] ... interface src6 dst6 [srcmac [dstmac [data]]]

Options:
  -T number       ICMPv6 type to send (default: 128 = ping)
  -C number       ICMPv6 code to send (default: 0)
  -S port         use a TCP SYN packet on the defined port instead of ping
  -U port         use a UDP packet on the defined port instead of ping
  -n count        how often to send the packet (default: 1)

fake_router6 — rogue Router Advertisement injection

$ atk6-fake_router6
Syntax: atk6-fake_router6 [-HFD] interface network-address/prefix-length [dns-server [router-ip-link-local [mtu [mac-address]]]]

Announce yourself as a router and try to become the default router.
If a non-existing link-local or mac address is supplied, this results in a DOS.

sudo atk6-fake_router6 eth0 2001:db8::/64

This is an active man-in-the-middle / DoS technique and must only ever be run in an isolated lab network you control.

parasite6 — IPv6 “ARP spoofing” equivalent

$ atk6-parasite6
Syntax: atk6-parasite6 [-lRFHD] interface [fake-mac]

This is an "ARP spoofer" for IPv6, redirecting all local traffic to your own
system (or nirvana if fake-mac does not exist) by answering falsely to
Neighbor Solicitation requests.

sudo atk6-parasite6 eth0

trace6 — IPv6 traceroute with header manipulation

$ atk6-trace6
Syntax: atk6-trace6 [-abdtu] [-s src6] interface targetaddress [port]

Options:
  -a       insert a hop-by-hop header with router alert option.
  -D       insert a destination extension header
  -F       insert a one-shot fragmentation header
  -b       instead of an ICMP6 Ping, use TooBig (you will not see the target)

sudo atk6-trace6 eth0 2001:db8::1

detect_sniffer6 — detect promiscuous-mode hosts on the segment

$ atk6-detect_sniffer6
Syntax: atk6-detect_sniffer6 interface [target6]

Tests if systems on the local LAN are sniffing.
Works against Windows, Linux, OS/X and *BSD

sudo atk6-detect_sniffer6 eth0

Real-World Use Cases (Authorized Lab Environments Only)

1. Validating IPv6 firewall/IDS coverage. Many organizations deploy strong IPv4 filtering but leave IPv6 wide open because it “isn’t really used yet” — running alive6 and thcping6 against a lab replica of the network quickly reveals whether IPv6 traffic is actually being inspected at all.

2. Testing SLAAC/NDP hardening. fake_router6 and parasite6 are the standard way to verify whether RA Guard, DHCPv6 Guard, or Source Address Validation are actually configured correctly on switches — these protections are frequently misconfigured or entirely absent.

3. Extension header handling audits. fragmentation6 and firewall6 test whether a firewall correctly reassembles and inspects fragmented IPv6 traffic rather than passing it through unfiltered — a known historical weak point in several vendor implementations.

4. Detecting IPv6-based lateral movement risk during a pentest. Many internal networks are IPv6-enabled by default (SLAAC without any network team ever explicitly deploying it), so THC-IPv6 tools reveal whether an attacker with a foothold could pivot laterally over IPv6 even when the organization believes their network is “IPv4-only.”

5. Detection capability testing for blue teams. Running detect_sniffer6 and DoS-style tools like ndpexhaust6 in a controlled purple-team exercise validates whether monitoring tools correctly alert on IPv6-layer attacks — a common blind spot compared to well-monitored IPv4 traffic.

Workflow and Tool Integration

# Step 1: discover live IPv6 hosts on the lab segment
sudo atk6-alive6 eth0

# Step 2: cross-check findings with Nmap's native IPv6 support
sudo nmap -6 -sV fe80::1%eth0

# Step 3: test RA Guard / NDP protections in a controlled window
sudo atk6-fake_router6 eth0 2001:db8:dead:beef::/64

# Step 4: confirm monitoring detected the injected RA (check SIEM/IDS alerts)

Performance and Environmental Notes

• Most tools require an interface bound to the local segment (eth0, wlan0) since NDP/RA-based attacks are inherently link-local.
• Root/sudo is required across virtually the entire suite since it crafts raw IPv6/ICMPv6 packets.
• Several attack tools (fake_router6, parasite6, flood tools) are genuinely disruptive by design — they are not “safe by default” the way a passive scanner is.

Troubleshooting Common Issues

Best Practices and Common Mistakes

• Never run attack tools (fake_router6, parasite6, flood/DoS tools) outside an isolated lab or an explicitly scoped, time-boxed penetration test window. These are genuinely disruptive — fake_router6 can take down IPv6 connectivity for an entire segment.
• Confirm written authorization covers IPv6-specific testing explicitly. Many scope documents are written with only IPv4 in mind; IPv6 attack techniques (rogue RAs, NDP spoofing) can have a much broader blast radius than a typical port scan.
• Coordinate with network operations before any RA-injection or flood test, even in an authorized engagement, since these attacks can affect infrastructure beyond the intended test scope if VLAN boundaries aren’t as isolated as assumed.
• Treat “IPv4-only” claims with skepticism. Most modern OSes have IPv6 enabled and SLAAC-configured by default; verifying actual dual-stack exposure is a standard, valuable part of network security assessments.
• Use the read-only/discovery tools first (alive6, address6, trace6) before ever running anything disruptive.

Practical Lab Example

# Isolated lab: two VMs on a virtual switch with IPv6 enabled, no physical network attached

# Discover hosts
sudo atk6-alive6 eth0

# Attempt to become the rogue default router (lab only)
sudo atk6-fake_router6 eth0 2001:db8:1::/64

# On the victim VM, confirm the rogue RA was accepted
ip -6 route show

FAQ

Is THC-IPv6 only useful if a network explicitly uses IPv6? No — many networks that believe they’re “IPv4-only” still have IPv6 enabled by default on hosts via SLAAC, which is exactly the blind spot these tools are designed to expose.

Are these tools inherently malicious? They’re dual-use, like most penetration testing tools — the same techniques used to test defenses can also be used maliciously. Authorization and scope are what determine legitimate use.

Do I need root privileges to run THC-IPv6 tools? Yes, virtually all of them require raw socket access to craft custom ICMPv6/IPv6 packets.

What’s the difference between alive6 and a standard Nmap -6 scan? alive6 is purpose-built for IPv6-specific discovery techniques (including multicast-based discovery unique to IPv6), while Nmap’s -6 flag extends its general-purpose scanning to IPv6 targets you already know about — they complement rather than replace each other.

Can fake_router6 cause a real outage? Yes — that’s exactly its design, either as an intentional DoS test or as a side effect of a misconfigured “non-existing” router address parameter. It should only ever be used in a controlled, isolated environment.

Summary

THC-IPv6 fills a gap that most mainstream security tooling still under-serves: the protocol-level attack surface unique to IPv6 — NDP, SLAAC, extension headers — that simply has no IPv4 equivalent. For anyone doing serious network security assessment work, treating IPv6 as an afterthought is increasingly a real gap, and this toolkit is the standard way to actually test it rather than assume it’s fine.

References

• Official GitHub repository: https://github.com/vanhauser-thc/thc-ipv6
• Man pages: man atk6-alive6, man atk6-fake_router6, and similarly for other tools in the suite