# dirkjanm/mitm6

pwning IPv4 via IPv6

Repository: https://github.com/dirkjanm/mitm6
Canonical: https://ross.abutalabs.com/products/mitm6
Language: Python
License: GPL-2.0
License Family: copyleft
Last push: 2024-02-20T16:11:53+00:00

## Health v2 (maintenance only)
Score: 23/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 0, release rhythm 8, longevity 100
- inputs: {"age_days": 3157, "days_push": 925, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1918, forks 265 (observed 2026-08-28T04:05:54.011710+00:00)

## What it is
mitm6 is a Python pentesting tool that exploits Windows' default IPv6 configuration by answering DHCPv6 requests, assigning victims a link-local IPv6 address, and setting the attacker's host as their DNS server. It then selectively spoofs DNS responses to redirect traffic and is designed to pair with impacket's ntlmrelayx for WPAD spoofing and credential relaying.

## Use cases
- spoof DNS in a Windows Active Directory network during a pentest
- perform DHCPv6 attacks to take over the default DNS server
- relay NTLM credentials captured via WPAD spoofing with ntlmrelayx
- demonstrate IPv6-based man-in-the-middle attacks on IPv4 networks
- test whether a network detects rogue router advertisements
- redirect victim traffic to an attacker machine via fake DNS answers

## When to choose
- you are conducting an authorized penetration test against a Windows/AD environment
- you need to combine DNS spoofing with NTLM credential relaying
- you want to demonstrate the risks of default IPv6/DHCPv6 configuration on Windows

## When to avoid
- you need a general-purpose DNS server or proxy rather than an attack tool
- your target network is not Windows-based or lacks DHCPv6-enabled hosts
- you cannot run with root privileges for raw packet capture
- you need a stealthy tool on networks that detect rogue router advertisements

## Facets
- artifact type: cli-tool
- maturity: maintenance
- function: security, penetration-testing, networking
- domain: security, penetration-testing, networking
- platform: python, cli
- tags: mitm, ipv6, dhcpv6, dns-spoofing, wpad, ntlm-relay, active-directory, pentesting, linux

## Member repositories
- dirkjanm/mitm6 (main) score 23

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:05:54.011710+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T03:10:00.010044+00:00, confidence not recorded.
  - readme: https://github.com/dirkjanm/mitm6 (fetched 2026-08-28T04:05:54.011710+00:00, sha f70c2bd4d8a7)
  - registry_pypi: https://pypi.org/pypi/mitm6/json (fetched 2026-08-29T10:49:18.051381+00:00, sha b7cb04ea16eb)
- Data as of 2026-08-30T08:39:29.467469+00:00.