Script ipv6-ra-flood

Script types: prerule
Categories: dos, intrusive
Download: https://svn.nmap.org/nmap/scripts/ipv6-ra-flood.nse

Script Summary

Generates a flood of Router Advertisements (RA) with random source MAC addresses and IPv6 prefixes. Computers, which have stateless autoconfiguration enabled by default (every major OS), will start to compute IPv6 suffix and update their routing table to reflect the accepted announcement. This will cause 100% CPU usage on Windows and platforms, preventing to process other application requests.

Vulnerable platforms:

  • All Cisco IOS ASA with firmware < November 2010
  • All Netscreen versions supporting IPv6
  • Windows 2000/XP/2003/Vista/7/2008/8/2012
  • All FreeBSD versions
  • All NetBSD versions
  • All Solaris/Illumos versions

Security advisory: http://www.mh-sec.de/downloads/mh-RA_flooding_CVE-2010-multiple.txt

WARNING: This script is dangerous and is very likely to bring down a server or network appliance. It should not be run in a production environment unless you (and, more importantly, the business) understand the risks!

Additional documents: https://tools.ietf.org/rfc/rfc6104.txt

Script Arguments

ipv6-ra-flood.interface

defines interface we should broadcast on

ipv6-ra-flood.timeout

runs the script until the timeout is reached (default: 30s). If timeout is zero, the script will run forever.

Example Usage

nmap -6 --script ipv6-ra-flood.nse
nmap -6 --script ipv6-ra-flood.nse --script-args 'interface=<interface>'
nmap -6 --script ipv6-ra-flood.nse --script-args 'interface=<interface>,timeout=10s'

Requires

Author:

  • Adam Števko

License: Same as Nmap--See https://nmap.org/book/man-legal.html