diff --git a/scripts/targets-ipv6-multicast-echo.nse b/scripts/targets-ipv6-multicast-echo.nse index 0198bbd8a..77ecf4c1c 100644 --- a/scripts/targets-ipv6-multicast-echo.nse +++ b/scripts/targets-ipv6-multicast-echo.nse @@ -1,6 +1,10 @@ description = [[ Multicast echo ping. -Do a very fast host discovery on link-local IPv6 network. + +This script works by sending an ICMPv6 Echo Request packet to the all-nodes +link-local multicast address, ff02::1. It can discover all hosts +responding to echo on an interface, without needing to individually ping each +address. ]] --- diff --git a/scripts/targets-ipv6-multicast-invalid-dst.nse b/scripts/targets-ipv6-multicast-invalid-dst.nse index 3f36a8719..1c1fa6b36 100644 --- a/scripts/targets-ipv6-multicast-invalid-dst.nse +++ b/scripts/targets-ipv6-multicast-invalid-dst.nse @@ -1,6 +1,11 @@ description = [[ -Multicast invalid destination options ping. -Do a very fast host discovery on link-local IPv6 network. +Multicast invalid packet host discovery. + +This script works by sending an ICMPv6 packet with an invalid extension header +to the all-nodes link-local multicast address, ff02::1. Some hosts +will respond to this probe with an ICMPv6 Parameter Problem packet. This script +can discover hosts reachable on an interface without needing to individually +ping each address. ]] --- diff --git a/scripts/targets-ipv6-multicast-slaac.nse b/scripts/targets-ipv6-multicast-slaac.nse index 514866419..b8aff49b7 100644 --- a/scripts/targets-ipv6-multicast-slaac.nse +++ b/scripts/targets-ipv6-multicast-slaac.nse @@ -1,6 +1,21 @@ description = [[ -SLAAC-based host discovery. -Do a very fast host discovery on link-local IPv6 network. +Does IPv6 host discovery by triggering stateless address auto-configuration +(SLAAC). + +This script works by sending an ICMPv6 Router Advertisement with a random +address prefix, which causes hosts to begin SLAAC and send a solicitation for +their newly configured address, as part of duplicate address detection. The +script then guesses the remote addresses by combining the link-local prefix of +the interface with the interface identifier in each of the received +solicitations. This should be followed up with ordinary ND host discovery to +verify that the guessed addresses are correct. + +The router advertisement has a router lifetime of zero and a short prefix +lifetime (a few seconds) + +See also: +* RFC 4862, IPv6 Stateless Address Autoconfiguration, especially section 5.5.3. +* http://dev.metasploit.com/redmine/projects/framework/repository/changes/modules/auxiliary/scanner/discovery/ipv6_neighbor_router_advertisement.rb ]] ---