PROTOCOL AUDIT & NETWORK RECON
Uncompromising network-level field manual. Dissect packets byte by byte, master Nmap's raw packet scanning heuristics, command Netfilter/iptables for defensive stateful firewalling & transparent traffic redirection, and audit core enterprise protocols across Layer 2 through Layer 7.
01 // WIRESHARK & TSHARK PACKET DISSECTION
Protocol mechanics, critical dissector fields, Wireshark display filters (-Y), and high-throughput CLI extraction using tshark -T fields.
ARP (Address Resolution Protocol - RFC 826)
LAYER 2/3
DISCOVERY
Protocol Core: Resolves IPv4 addresses to Ethernet MACs via broadcast requests (
opcode 1) and unicast replies (opcode 2). Because ARP is stateless and unauthenticated, devices unconditionally update their ARP cache when receiving replies (Gratuitous ARP / Poisoning vulnerability).
arp.opcode1 = Request, 2 = Reply
arp.src.proto_ipv4Sender IPv4 address
arp.src.hw_macSender physical MAC address
arp.dst.proto_ipv4Target IPv4 address
arp.dst.hw_macTarget physical MAC address
arp.duplicate-address-detectedCollision flag (critical for detecting ARP spoofing)
Wireshark Display Filter (Detect ARP Poisoning / Replies)
arp.opcode == 2 || arp.duplicate-address-detected
Tshark Live Extraction (Sender IP & MAC Mapping)
sudo tshark -i eth0 -f "ether proto \arp" -n -T fields -e arp.src.proto_ipv4 -e arp.src.hw_mac -e arp.dst.proto_ipv4 -e arp.dst.hw_mac -E header=y
DNS (Domain Name System - RFC 1035)
LAYER 7
TELEMETRY
Protocol Core: Runs primarily over UDP port 53 (TCP for zone transfers and large responses >512 bytes). Queries (
qr == 0) and Responses (qr == 1). Analyzing query frequency, NXDomain rates, and TXT record entropy reveals C2 communication channels, tunneling, and internal reconnaissance.
dns.flags.response0 = Query, 1 = Response
dns.qry.nameQueried Fully Qualified Domain Name (FQDN)
dns.qry.type1 = A, 28 = AAAA, 15 = MX, 16 = TXT, 12 = PTR
dns.a / dns.aaaaResolved IPv4 or IPv6 address
dns.flags.rcodeResponse status: 0 = NoError, 3 = NXDomain
dns.txtText record payload (frequent tunnel carrier)
Wireshark Display Filter (Identify Suspicious TXT Records / C2)
dns.qry.type == 16 || (dns.flags.response == 1 && dns.flags.rcode == 3)
Tshark Live Query Stream (Source, Target Domain, Resolved IP)
sudo tshark -i eth0 -f "src port 53" -n -T fields -e ip.dst -e dns.qry.name -e dns.a -Y "dns.flags.response == 1"
IPv6 & ICMPv6 (NDP & SLAAC - RFC 4861)
LAYER 3
INSPECTION
Protocol Core: IPv6 eliminates broadcast in favor of multicast and uses ICMPv6 Neighbor Discovery Protocol (NDP). Router Advertisements (RA, type 134) dynamically configure default gateways and DNS without DHCP (SLAAC). Windows defaults to prioritizing IPv6 DNS resolution over IPv4, opening the door for rogue RA/DHCPv6 takeovers.
icmpv6.type133 = RS, 134 = RA, 135 = NS, 136 = NA
icmpv6.nd.ra.router_lifetimeGateway lifetime (>0 advertises default router)
icmpv6.nd.na.target_addrTarget IPv6 address in Neighbor Advertisement
ipv6.src / ipv6.dstSource & Destination IPv6 addresses
Wireshark Display Filter (Detect Rogue Router Advertisements)
icmpv6.type == 134 && icmpv6.nd.ra.router_lifetime > 0
Tshark Stream (Extract IPv6 NDP Router Advertisements)
sudo tshark -i eth0 -Y "icmpv6.type == 134" -T fields -e ipv6.src -e eth.src -e icmpv6.nd.ra.router_lifetime -E header=y
DHCP & DHCPv6 (Dynamic Configuration)
LAYER 7
AUDIT
Protocol Core: IPv4 DORA cycle (Discover, Offer, Request, ACK) over UDP 67/68. DHCPv6 operates over UDP 546/547 (Solicit, Advertise, Request, Reply). Intercepting Offer and ACK packets identifies unauthorized rogue DHCP servers injecting malicious gateways or DNS servers into the subnet.
dhcp.option.dhcp1 = Discover, 2 = Offer, 3 = Request, 5 = ACK
dhcp.ip.serverDHCP Server Identifier
dhcp.ip.yourClient IP address assigned
dhcp.option.routerDefault gateway option (Option 3)
dhcp.option.domain_name_serverDNS servers delivered (Option 6)
dhcpv6.msgtype1 = Solicit, 2 = Advertise, 7 = Reply
Wireshark Display Filter (Detect Rogue DHCP Offers & ACKs)
dhcp.option.dhcp == 2 || dhcp.option.dhcp == 5 || dhcpv6.msgtype == 2
Tshark Live Extraction (DHCP Server IP, Assigned IP, Gateway & DNS)
sudo tshark -i eth0 -f "udp port 67 or udp port 68" -n -T fields -e ip.src -e dhcp.ip.server -e dhcp.ip.your -e dhcp.option.router -e dhcp.option.domain_name_server -E header=y
SMB / SMB2 / SMB3 (Server Message Block - Port 445)
LAYER 7
LATERAL AUDIT
Protocol Core: Microsoft file sharing and remote IPC mechanism. Commands flow through Negotiate (
0x00), Session Setup (0x01), Tree Connect (0x03), and Create (0x05). Crucial for tracking lateral movement, remote service registration (\pipe\svcctl), and unauthorized administrative share access (C$, ADMIN$, IPC$).
smb2.cmdCommand opcode (0=NegProt, 1=SessSetup, 3=TreeConn, 5=Create)
smb2.treeConnected network share path (e.g. \\DC01\IPC$)
smb2.filenameAccessed filename or RPC Named Pipe
smb2.nt_statusStatus code (0x0 = SUCCESS, 0xc000006d = LOGON_FAILURE)
smb2.session_idUnique authenticated session identifier
Wireshark Display Filter (Identify Share Access & Failed Logons)
(smb2.cmd == 3 && smb2.tree) || (smb2.nt_status == 0xc000006d)
Tshark Stream (Capture File & Named Pipe Access Over SMB)
sudo tshark -i eth0 -f "tcp port 445" -Y "smb2.cmd == 5 && smb2.filename" -T fields -e ip.src -e ip.dst -e smb2.filename | grep -E "(\.exe|\.bat|\.ps1|pipe)"
NTLMSSP (NTLM Security Support Provider)
LAYER 7
AUTH DISSECTION
Protocol Core: 3-way challenge-response authentication transported over SMB, HTTP, or LDAP: Type 1 (
Negotiate), Type 2 (Challenge with 8-byte server challenge), and Type 3 (Authenticate with client username, domain, and encrypted response). Extracting these allows assembling offline crackable NetNTLMv2 hashes (Hashcat mode 5600: user::domain:server_challenge:ntlmv2_response:target_info).
ntlmssp.messagetype0x01 = Negotiate, 0x02 = Challenge, 0x03 = Authenticate
ntlmssp.auth.usernameAuthenticating user identity
ntlmssp.auth.domainTarget Active Directory domain or workgroup
ntlmssp.ntlmserverchallenge8-byte hex server challenge
ntlmssp.ntlmv2_responseClient cryptographic response (HMAC-MD5)
ntlmssp.challenge.target_infoTarget server metadata & timestamp
Wireshark Display Filter (Isolate Type 3 Authentications)
ntlmssp.messagetype == 0x00000003
Tshark Stream (Extract Full NetNTLMv2 Authentication Parameters)
sudo tshark -i eth0 -T fields -Y "ntlmssp" -e ip.src -e ntlmssp.auth.domain -e ntlmssp.auth.username -e ntlmssp.ntlmserverchallenge -e ntlmssp.ntlmv2_response -e ntlmssp.challenge.target_info
KERBEROS (Active Directory Authentication - Port 88)
LAYER 7
AD TELEMETRY
Protocol Core: Trusted third-party authentication via Key Distribution Center (KDC).
AS-REQ / AS-REP (msg 10/11) authenticates user and grants TGT. TGS-REQ / TGS-REP (msg 12/13) issues Service Tickets encrypted with target service account keys. Kerberoasting appears in telemetry as TGS-REQs for high-privilege SPNs requesting weak RC4-HMAC (etype 23) tickets.
kerberos.msg_type10=AS-REQ, 11=AS-REP, 12=TGS-REQ, 13=TGS-REP, 30=KRB-ERROR
kerberos.CNameStringRequesting client username
kerberos.sname_stringTarget Service Principal Name (SPN: MSSQL, CIFS, HTTP)
kerberos.etypeTicket cipher: 23 = RC4-HMAC (crackable), 18 = AES-256
kerberos.cipherEncrypted ticket payload (Roasting target)
Wireshark Display Filter (Detect Kerberoasting: TGS-REP with RC4)
kerberos.msg_type == 13 && kerberos.etype == 23
Tshark Command (Audit Client Usernames & Requested SPNs)
sudo tshark -r ad_traffic.pcap -Y "kerberos.msg_type == 12" -T fields -e ip.src -e kerberos.CNameString -e kerberos.sname_string | sort -u
02 // NMAP ENGINE MECHANICS & RECONNAISSANCE
Raw socket state-machine heuristics, stealth handshake mechanics, version scanning probes, NSE automation, and IDS/firewall evasion.
[Nmap Host Discovery & Port State Machine]
1. SYN Stealth Scan (-sS):
Attacker ---[ SYN ]------------> Target:Port
Attacker <---[ SYN/ACK ]--------- Target:Port ==> [ PORT OPEN ]
Attacker ---[ RST ]------------> Target:Port (Tears down half-open socket; avoids full TCP app logs)
Attacker <---[ RST/ACK ]--------- Target:Port ==> [ PORT CLOSED ]
Attacker <---[ No response / ICMP Type 3 ]--- ==> [ PORT FILTERED ]
2. UDP Scan (-sU):
Attacker ---[ UDP Probe ]-------> Target:Port
Attacker <---[ ICMP Type 3 Code 3 (Port Unreachable) ]- ==> [ PORT CLOSED ]
Attacker <---[ UDP App Response ]---------------------- ==> [ PORT OPEN ]
Attacker <---[ No response ]--------------------------- ==> [ OPEN | FILTERED ]
Port Scan Engines & Handshake Mechanics
TRANSPORT
CORE ENGINE
Engine Mechanics:
•
•
•
•
•
-sS (TCP SYN Stealth): Raw socket sends SYN. Evaluates response (SYN/ACK = Open, RST = Closed). Sends immediate RST before completing handshake, bypassing older app-layer connection logs. Requires root.
•
-sT (TCP Connect): Uses standard OS connect() syscall. Completes full 3-way handshake. Unprivileged fallback or used through SOCKS proxies.
•
-sU (UDP Scan): Sends empty or protocol-specific UDP probes. ICMP Port Unreachable = Closed. No response = Open|Filtered. Slow due to Linux kernel ICMP rate-limits (1/sec).
•
-sA (TCP ACK): Sends ACK. RST response = Unfiltered (packet passed firewall). No response = Filtered (stateful inspection dropped packet). Maps firewall ACLs.
SYN Stealth Scan (Fast, Top 1000 Ports, OS/Service Detection)
sudo nmap -sS -sV -O -T4 -p- --min-rate 1000 -oA full_syn_scan 192.168.1.0/24
Targeted UDP Scan (Critical Enterprise Services)
sudo nmap -sU -sV -p 53,67,69,88,123,161,389,500,514 -oN udp_recon.txt 192.168.1.100
Host Discovery & Ping Sweep Architectures
NETWORK
SWEEPS
Probe Matrix: By default, Nmap pings targets before port scanning. In enterprise networks where standard ICMP Echo (
•
•
•
-PE) is blocked:
•
-PR: ARP Ping. Default on local subnet. Unblockable at Layer 3; targets must respond to communicate over Ethernet.
•
-PS & -PA: TCP SYN/ACK ping to specific ports (e.g. 80, 443, 22, 3389). Probes pass through stateful boundaries.
•
-Pn: Disable host discovery entirely; treat all targets as online. Essential against hardened Windows endpoints.
Local Subnet ARP Discovery Sweep (Zero Port Scan Overhead)
sudo nmap -sn -PR 192.168.1.0/24
Stealth Multi-Vector Host Discovery (SYN 443 + ACK 80 + ICMP Timestamp)
sudo nmap -sn -PS443 -PA80 -PP 10.10.0.0/16
Nmap Scripting Engine (NSE) Mastery
LUA SCRIPTS
AUTOMATION
Script Categories: Embedded Lua scripts residing in
NSE can enumerate SMB shares, extract SSL certificate chains, test HTTP methods, and brute-force subdomains.
/usr/share/nmap/scripts/. Categories include: default (fast, low intrusion), discovery (queries registry, shares, DNS), vuln (checks for known CVEs), and auth (audits authentication bypasses).
NSE can enumerate SMB shares, extract SSL certificate chains, test HTTP methods, and brute-force subdomains.
SMB & Active Directory Comprehensive Audit
nmap -p 445 --script "smb-enum-shares,smb-os-discovery,smb-security-mode" -oN smb_audit.txt 192.168.1.50
Web Server Surface & TLS Cryptographic Audit
nmap -p 80,443 --script "http-title,http-headers,http-methods,ssl-enum-ciphers" 192.168.1.100
Firewall, IDS/IPS Evasion & Spoofing Techniques
EVASION
TACTICAL
Defeating Perimeter Heuristics:
•
•
•
•
•
-D RND:10: Decoy scanning. Injects 10 randomly generated source IPs into the network alongside your legitimate IP to flood SIEM/IDS logs.
•
-g 53 / --source-port 88: Source port manipulation. Exploits legacy firewall rules that blindly trust inbound traffic originating from DNS (53) or Kerberos (88).
•
-f / --mtu 16: Packet fragmentation. Splits the TCP header across multiple 8/16-byte IP fragments, evading signature inspection that fails to reassemble packets.
•
--data-length 32: Appends random payload bytes to mask standard 0-byte Nmap scan signatures.
Hardened Perimeter Evasion (Decoys + Port 53 + Fragmentation + Padding)
sudo nmap -sS -Pn -g 53 -D RND:5 -f --data-length 24 --min-rate 100 -p 80,443,8443 192.168.1.100
MAC Address Hardware Spoofing (Bypass 802.1X / MAC Filters)
sudo nmap -sS -Pn --spoof-mac Cisco -e eth0 192.168.1.1
03 // IPTABLES & NETFILTER ARCHITECTURE
Stateful packet filtering, connection tracking tables, PREROUTING/POSTROUTING translation, lab traffic redirection, and Layer 3 IP spoofing mitigation.
[Linux Netfilter Packet Flow Traversal]
+-----------------+
Incoming Packet -------------------> | PREROUTING |
| (raw/mangle/nat)|
+--------+--------+
|
[ Routing Decision ]
/ \
[ Local Destination ] [ Remote Destination ]
/ \
+---------+-------+ +-------+---------+
| INPUT | | FORWARD |
| (mangle/filter) | | (mangle/filter) |
+---------+-------+ +-------+---------+
| |
[Local Process] |
| |
+---------+-------+ |
Outgoing Packet <------- | OUTPUT | |
| (raw/mangle/nat/filter) |
+---------+-------+ |
| |
\ /
[ Routing Decision ]
|
+--------+--------+
| POSTROUTING | <-- Out to Wire
| (mangle/nat) |
+-----------------+
Stateful Firewall Hardening (Production Baseline)
DEFENSE
STATEFUL
Hardened Architecture: Default-deny security posture. Drops all incoming and routed traffic, allows loopback communication, leverages
conntrack to automatically accept established connections, and throttles brute-force connection attempts on administrative ports using the recent module.
Complete Stateful Baseline Ruleset (Flush, Default DROP, Stateful Permit)
# 1. Flush existing chains & custom tables sudo iptables -F && sudo iptables -X && sudo iptables -t nat -F # 2. Default Policy: Drop incoming & forwarded traffic, permit outbound sudo iptables -P INPUT DROP sudo iptables -P FORWARD DROP sudo iptables -P OUTPUT ACCEPT # 3. Allow Loopback interface unconditionally sudo iptables -A INPUT -i lo -j ACCEPT sudo iptables -A OUTPUT -o lo -j ACCEPT # 4. Permit Established & Related return packets (conntrack engine) sudo iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT # 5. Allow SSH with rate-limiting (Max 4 new connections / minute) sudo iptables -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW -m recent --set --name SSH sudo iptables -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW -m recent --update --seconds 60 --hitcount 4 --name SSH -j DROP sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT # 6. Allow Web Traffic (HTTP/HTTPS) & rate-limited ICMP sudo iptables -A INPUT -p tcp -m multiport --dports 80,443 -j ACCEPT sudo iptables -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT # 7. Log dropped packets before discarding sudo iptables -A INPUT -m limit --limit 5/min -j LOG --log-prefix "FW-DROP: " --log-level 4
NAT, Lab Redirection & Transparent Proxying
LAB REDIRECTION
NAT
Redirection & Pivoting Mechanics:
•
•
•
•
PREROUTING REDIRECT: Rewrites the destination IP of transit packets arriving on an interface to the local host. Used in security labs to intercept HTTP/HTTPS traffic through transparent proxies (Burp Suite, mitmproxy).
•
PREROUTING DNAT: Destination NAT; forwards incoming traffic destined for a specific port to an internal jumpbox/target inside an isolated subnet.
•
POSTROUTING MASQUERADE: Rewrites the source IP of forwarded packets to the outgoing interface IP, allowing an auditor machine to function as a gateway router.
Transparent HTTP/HTTPS Redirection to Local Interception Proxy
# Enable Kernel Packet Forwarding sudo sysctl -w net.ipv4.ip_forward=1 # Redirect transit HTTP (80) to local proxy listening on 8080 sudo iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 8080 # Redirect transit HTTPS (443) to local proxy listening on 8443 sudo iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -j REDIRECT --to-port 8443
Gateway Masquerading (NAT Gateway for Lab Segment)
sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE sudo iptables -A FORWARD -i eth1 -o eth0 -j ACCEPT sudo iptables -A FORWARD -i eth0 -o eth1 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
Port Forwarding / Pivot Jumpbox (DNAT External Port to Internal Host)
sudo iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 2222 -j DNAT --to-destination 10.10.10.50:22
IP Spoofing: Mechanics, Risks & Netfilter Hardening
ANTI-SPOOFING
LAYER 3
Threat & Defense Model:
• Vulnerability: IP headers contain a 32-bit source address field that standard destination-based routers do not validate. Attackers inject forged source IPs using raw sockets (
• Ingress Filtering (BCP 38 / RFC 2827): Firewalls must drop packets claiming to originate from private (RFC 1918), loopback, or broadcast ranges arriving on external-facing interfaces.
• Reverse Path Filtering (rp_filter): Kernel mechanism that verifies whether a return path to the packet's source IP routes back through the same interface it arrived on. If not, the packet is discarded as spoofed.
• Vulnerability: IP headers contain a 32-bit source address field that standard destination-based routers do not validate. Attackers inject forged source IPs using raw sockets (
SOCK_RAW). While TCP return traffic routes back to the legitimate IP owner (preventing interactive sessions), UDP reflection attacks (DNS/NTP) and blind TCP resets exploit this gap.
• Ingress Filtering (BCP 38 / RFC 2827): Firewalls must drop packets claiming to originate from private (RFC 1918), loopback, or broadcast ranges arriving on external-facing interfaces.
• Reverse Path Filtering (rp_filter): Kernel mechanism that verifies whether a return path to the packet's source IP routes back through the same interface it arrived on. If not, the packet is discarded as spoofed.
Kernel Strict Reverse Path Filtering & Martian Logging
# Enforce strict reverse path filtering across all interfaces sudo sysctl -w net.ipv4.conf.all.rp_filter=1 sudo sysctl -w net.ipv4.conf.default.rp_filter=1 # Log impossible source addresses (Martians) to syslog sudo sysctl -w net.ipv4.conf.all.log_martians=1
iptables Ingress Anti-Spoofing Filters (External Interface eth0)
# Drop packets claiming to be loopback arriving from outside sudo iptables -A INPUT -i eth0 -s 127.0.0.0/8 -j DROP # Drop RFC 1918 Private Ranges arriving on External WAN Interface sudo iptables -A INPUT -i eth0 -s 10.0.0.0/8 -j DROP sudo iptables -A INPUT -i eth0 -s 172.16.0.0/12 -j DROP sudo iptables -A INPUT -i eth0 -s 192.168.0.0/16 -j DROP # Drop Link-Local & Multicast Ingress sudo iptables -A INPUT -i eth0 -s 169.254.0.0/16 -j DROP sudo iptables -A INPUT -i eth0 -s 224.0.0.0/4 -j DROP
Mangle Table TTL Normalization (Hide Network Hop Geometry)
sudo iptables -t mangle -A POSTROUTING -j TTL --ttl-set 64
Ruleset Inspection, Diagnostics & Persistence
ADMIN
DIAGNOSTICS
Rule Verification: Iptables executes rules top-down sequentially. Monitoring packet counters (
-v), displaying numeric IPs without reverse-DNS lag (-n), and listing line numbers (--line-numbers) is vital for troubleshooting conflicts and diagnosing blocked traffic.
Detailed Ruleset Listing with Packet/Byte Counters & Line Numbers
sudo iptables -L -v -n --line-numbers
Inspect NAT Table Tables & Connection Counters
sudo iptables -t nat -L -v -n --line-numbers
Atomic Save & Restore Operations
# Export active ruleset atomically sudo iptables-save | sudo tee /etc/iptables/rules.v4 # Restore ruleset from persistent storage sudo iptables-restore < /etc/iptables/rules.v4
04 // LAYER 2 RECON, PROTOCOL POISONING & AD AUDITING
Layer 2 broadcast discovery, LLMNR/NBT-NS fallback poisoning mechanics, IPv6 DNS takeover architecture, and Active Directory protocol defenses.
Subnet Discovery: netdiscover & arp-scan
LAYER 2
SWEEP
Mechanism: Sends raw ARP requests across Ethernet broadcast addresses. Because ARP resolution occurs below the IP layer, endpoints cannot communicate on Ethernet without answering ARP requests. This completely bypasses local firewalls (like Windows Defender Firewall) that discard ICMP pings.
netdiscover Active & Passive Interface Reconnaissance
# Passive Sniffing (Zero outbound packets generated) sudo netdiscover -i eth0 -p # Active Subnet Sweep sudo netdiscover -i eth0 -r 192.168.1.0/24
arp-scan (Rapid Localnet Sweep with OUI Vendor Lookup)
sudo arp-scan --interface=eth0 --localnet --retry=3 --timeout=500
LLMNR / NBT-NS Poisoning & WPAD Auditing (Responder)
LAYER 7
NAME FALLBACK
Fallback Flow: When a Windows host fails to resolve a hostname via DNS, it falls back to broadcasting LLMNR (UDP 5355) and NetBIOS Name Service (UDP 137). Responder listens for these broadcasts, claims to own the requested resource, and requests NTLM authentication to capture crackable NetNTLMv2 hashes.
Mitigation: Disable LLMNR and NBT-NS via Group Policy Objects (GPO), enforce SMB Signing (
Mitigation: Disable LLMNR and NBT-NS via Group Policy Objects (GPO), enforce SMB Signing (
RequireSecuritySignature = 1), and enable LDAP Channel Binding.
Responder Execution (WPAD Rogue Server + Force Auth + Verbose)
sudo responder -I eth0 -wFv
Extract & Crack NetNTLMv2 Hashes with Hashcat (Mode 5600)
hashcat -m 5600 ntlmv2_hashes.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule -O
IPv6 DNS Takeover Architecture (mitm6)
LAYER 3/7
PROTOCOL TAKEOVER
Attack Anatomy:
1. Modern Windows workstations have IPv6 enabled by default and periodically broadcast DHCPv6 Solicit messages.
2.
3. Windows prioritizes IPv6 DNS over IPv4 DNS. When the victim requests resources or WPAD configuration, queries route to the rogue DNS server, allowing authentication relaying (e.g. ntlmrelayx targeting LDAP/LDAPS).
Defensive Remediation: Implement DHCPv6 Guard on access switches, disable WPAD via GPO, require LDAP signing, and unbind IPv6 on interfaces where not routed.
1. Modern Windows workstations have IPv6 enabled by default and periodically broadcast DHCPv6 Solicit messages.
2.
mitm6 replies to DHCPv6 requests, assigning a link-local IPv6 address and advertising the auditor's IP as the primary DNS server.
3. Windows prioritizes IPv6 DNS over IPv4 DNS. When the victim requests resources or WPAD configuration, queries route to the rogue DNS server, allowing authentication relaying (e.g. ntlmrelayx targeting LDAP/LDAPS).
Defensive Remediation: Implement DHCPv6 Guard on access switches, disable WPAD via GPO, require LDAP signing, and unbind IPv6 on interfaces where not routed.
mitm6 Execution (Target Specific AD Domain Segment)
sudo mitm6 -i eth0 -d bleach.local -l bleach.local
Defense: PowerShell Script to Disable IPv6 Bindings Across Adapters
Disable-NetAdapterBinding -Name "*" -ComponentID ms_tcpip6
Active Directory Protocol Hardening Checklist
ENTERPRISE HARDENING
POLICY
Enterprise Defense Matrix:
• Disable NTLMv1: Enforce
• SMB Signing: Require SMB signing on all domain controllers and member servers to neutralize SMB Relay attacks.
• LDAP Signing & Channel Binding: Configure
• Kerberos Pre-Authentication: Audit user accounts with
• Service Account Passwords: Use Managed Service Accounts (gMSA) with 128-character automatically rotated passwords to neutralize Kerberoasting offline cracking.
• Disable NTLMv1: Enforce
Send NTLMv2 response only. Refuse LM & NTLM via GPO.
• SMB Signing: Require SMB signing on all domain controllers and member servers to neutralize SMB Relay attacks.
• LDAP Signing & Channel Binding: Configure
LdapServerIntegrity = 2 and LdapEnforceChannelBinding = 2 to block NTLM relay into LDAP.
• Kerberos Pre-Authentication: Audit user accounts with
DONT_REQ_PREAUTH enabled to eliminate AS-REP Roasting exposure.
• Service Account Passwords: Use Managed Service Accounts (gMSA) with 128-character automatically rotated passwords to neutralize Kerberoasting offline cracking.
Audit Accounts with Pre-Authentication Disabled (PowerView / ActiveDirectory Module)
Get-ADUser -Filter {DoesNotRequirePreAuth -eq $True} -Properties DoesNotRequirePreAuth | Select-Object SamAccountName
[!] NO COMMANDS OR PROTOCOLS MATCHED YOUR SEARCH QUERY.