mitm6 – compromising IPv4 networks via IPv6

This report describes mitm6, an IPv6-based DNS spoofing and WPAD abuse technique targeting Windows hosts that prefer IPv6 DNS: the attacker answers DHCPv6 requests to set themselves as the victim's DNS server, spoofs WPAD to force proxy usage, triggers HTTP proxy authentication, captures NTLM challenge/response, and uses ntlmrelayx to relay credentials and access internal services. The blog explains attack phases, demonstrates automation with mitm6 and ntlmrelayx, provides Snort/Suricata detection signatures, and recommends mitigations including disabling unused IPv6, disabling WPAD, and moving away from NTLM.