I'm trying to do a Man In The Middle between a computer and a device which communicate only using IPv6 link-local addresses. I've used ettercap in a Kali Linux VM to successfully put myself between the two so the first step is OK. I used burp proxy in invisible proxying mode to redirect the requests to the device and be able to see what is echanged but because the requests are sent to the link-local address of the device, they do not reach the Burp proxy on the VM.

Is there a way to configure the interface of the Kali Linux VM so that the packets are sent to the listening socket of the Burp proxy ? I cannot set the ipv6 link-local address of the interface as the one of the device because it will then be duplicated on the network. Would setting the ipv6 link local address of the device on the localhost interface work ?

Is there a way to configure linux so that ipv6 link local addresses are forwarded ?

If not I've thought of a few possibilities to make it work:

  • Configure the ipv6 link-local address of the device on the interface in the KALI VM and create iptable rules which blocks the NDP replies so that the linux VM doesn't see the address is already used. It should allow Burp proxy to receive the request and probably answer the SYN-ACK. But the requests have to be sent to the device ipv6 address which will also be on the interface so I'm not sure the request will be forwarded.

  • use scapy to "copy" the packet sent by the computer to the device and only change the ipv6 link local destination address to be the one of the Kali VM. I then need to make an iptable rules to drop the answer and again use scapy to copy the answer and this time rewrite the ipv6 source address

What do you think ? Can either of those solutions work ? Is there an easier one ?

Thank you

  • This is not a security question but a network config question for this linux distro – schroeder Apr 17 at 17:05
  • (This will have to wait for I C to register here). As I'm not versed in mitm attacks, can you describe the topology and what kind of mitm configuration you have? Is all of the traffic between the computer system and the device flowing through your VM, or are you only diverting (some of) it with ettercap and NDP poisoning? If you even gave a reproducible example (with fake IPv6 addresses from rfc 3849 or fake link local addresses that should match a fake ethernet MAC address when adequate) this would help avoiding misunderstandings. – A.B Apr 19 at 13:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy