Mu Dynamics Blog » IPv6 Fuzzing and Testing

July 22, 2009 by kowsik

At Mu, we take testing IPv6 pretty seriously, especially since the IPv4 address space is vanishing faster than you say all octets of an IPv6 address. We released our first version of IPv6 test suite for fuzzing 3 years ago which includes coverage for fragmentation, various extension headers and and options. Most of the fun in fuzzing IPv6 happens with the extension headers which are much like IPv4 options, except it’s a chained linked-list like IKE payloads. In the one of the IPv6 test suites, we have more than 100,000 test cases that exercise various parts of the IPv6 capabilities!

Since then we’ve added IPv6 as a selectable transport to all of our IPv6 capable protocols and cooler yet you can run the same protocol as both IPv4 and IPv6 (dual stack anyone?) within the same analysis against the same target. Here are all the different ways we can test IPv6 within the Mu Test Suite:

	As mentioned above we provide test suites for IPv6 fuzzing in addition to making it a selectable transport for higher layer protocols. More importantly the higher layer protocols are IPv6 aware. For example embedded IPv6 addresses in HTTP are encoded differently and the HTTP fuzzing suite automatically adds IPv6 address fuzzing!
	The DoS module supports IPv6 transport natively so we can generate, say SIP INVITE over IPv6 packets with payload randomization with just a few clicks! Even better, you can pretty much pick any IPv6 pcap from pcapr and with just three steps convert a packet into a DoS template. You can read more about our DoS methodology in my earlier blog.
	The Published Vulnerability module used for testing IPS and DPI for signature/anomaly detection effectiveness allows you to run each vulnerability trigger over IPv6. And an industry first: we’ve since added IPv6 fragmentation as an evasion option which is just awesome. If your IPS/DPI does a store-and-forward of IPv6 fragments in order to properly reassemble IPv6/TCP streams, then this is a great way to verify the effectiveness of these devices.
	With the recent addition of Studio to our Test Suite, it’s super easy to upload an IPv6 pcap and with just a few clicks convert the pcap into a fuzzer. It works both through devices like firewalls, DPI and IPS as well as does one-arm testing: a.k.a. server testing. So before you think it’s packet replay, it’s more like Load Runner’s capture/replay. Studio supports both parametrization and correlation which are key to making the pcap work against a server effectively.
	Last but not the least, the Mu platform supports notions of channels and monitors where as part of your testing, you can have us reach out into systems and run commands, grep for core files and tell us if you’ve found an internal failure. All of these run over IPv6. This means that you could be testing an IPv6 DoS while you’ve telnet into the system-under-test over IPv4 and run various commands.