dirkjanm/mitm6

Health v2 · maintenance only

Adoption not part of the score

1918 stars · 265 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

mitm6 is a Python pentesting tool that exploits Windows' default IPv6 configuration by answering DHCPv6 requests, assigning victims a link-local IPv6 address, and setting the attacker's host as their DNS server. It then selectively spoofs DNS responses to redirect traffic and is designed to pair with impacket's ntlmrelayx for WPAD spoofing and credential relaying.

Use cases

• spoof DNS in a Windows Active Directory network during a pentest
• perform DHCPv6 attacks to take over the default DNS server
• relay NTLM credentials captured via WPAD spoofing with ntlmrelayx
• demonstrate IPv6-based man-in-the-middle attacks on IPv4 networks
• test whether a network detects rogue router advertisements
• redirect victim traffic to an attacker machine via fake DNS answers

When to choose

• you are conducting an authorized penetration test against a Windows/AD environment
• you need to combine DNS spoofing with NTLM credential relaying
• you want to demonstrate the risks of default IPv6/DHCPv6 configuration on Windows

When to avoid

• you need a general-purpose DNS server or proxy rather than an attack tool
• your target network is not Windows-based or lacks DHCPv6-enabled hosts
• you cannot run with root privileges for raw packet capture
• you need a stealthy tool on networks that detect rogue router advertisements

Facets

cli-tool · maturity maintenance

security penetration-testing networking security penetration-testing networking python cli mitm ipv6 dhcpv6 dns-spoofing wpad ntlm-relay active-directory pentesting linux

Member repositories

For agents

markdown · JSON · MCP: product_card(name="dirkjanm/mitm6")