Dual-stack attacks (IPv4 and IPv6)¶

1. Dual-Stack Attacks [OR]

    1.1 Protocol Preference Exploitation [OR]
    
        1.1.1 IPv6 Priority Bypass
            1.1.1.1 Exploiting Happy Eyeballs algorithms to force IPv6 preference
            1.1.1.2 Using IPv6-only features to bypass IPv4-specific security controls
            1.1.1.3 Manipulating DNS responses (AAAA vs. A records) to control protocol selection
            
        1.1.2 Fallback Manipulation
            1.1.2.1 Deliberately causing IPv6 failures to force fallback to vulnerable IPv4 paths
            1.1.2.2 Timing attacks to disrupt protocol negotiation
            1.1.2.3 DNS cache poisoning to influence protocol selection
            
    1.2 Asymmetric Security Bypass [OR]
    
        1.2.1 Differential Security Policies
            1.2.1.1 Exploiting gaps between IPv4 and IPv6 firewall rules
            1.2.1.2 Bypassing IPv4-only IDS/IPS systems via IPv6 paths
            1.2.1.3 Leveraging inconsistent security group configurations across protocols
            
        1.2.2 Monitoring Evasion
            1.2.2.1 Using IPv6 for stealth where IPv4 monitoring is more robust
            1.2.2.2 Exploiting lack of IPv6 logging and audit capabilities
            1.2.2.3 Avoiding detection by switching protocols mid-session
            
    1.3 Transition Mechanism Exploitation [OR]
    
        1.3.1 Tunneling Abuse
            1.3.1.1 Exploiting 6to4, Teredo, or ISATAP tunnels for evasion
            1.3.1.2 Using tunnels to bypass network perimeter controls
            1.3.1.3 Embedding malicious payloads in tunneled traffic
            
        1.3.2 Translation Attacks
            1.3.2.1 NAT64/DNS64 manipulation for traffic interception
            1.3.2.2 Protocol translation vulnerabilities causing state inconsistencies
            1.3.2.3 Stateless IP/ICMP Translation (SIIT) exploits
            
    1.4 Address Spoofing and Manipulation [OR]
    
        1.4.1 Cross-Protocol Spoofing
            1.4.1.1 Using IPv6 to spoof IPv4 addresses or vice versa
            1.4.1.2 Exploiting address mapping mechanisms in transition technologies
            1.4.1.3 Forging addresses to bypass protocol-specific authentication
            
        1.4.2 DNS-Based Attacks
            1.4.2.1 AAAA record poisoning to redirect IPv6 traffic
            1.4.2.2 DNS64 manipulation for translation attacks
            1.4.2.3 Double DNS poisoning affecting both protocol stacks
            
    1.5 Resource Exhaustion [OR]
    
        1.5.1 Double-Stack Resource Consumption
            1.5.1.1 Attacking both protocol stacks simultaneously to maximize impact
            1.5.1.2 Exploiting dual-stack memory and CPU overhead
            1.5.1.3 Caching attacks against both IPv4 and IPv6 resolution systems
            
        1.5.2 State Table Attacks
            1.5.2.1 Exhausting connection tracking resources for both protocols
            1.5.2.2 Double SYN flooding against dual-stack services
            1.5.2.3 Exploiting NAT44 and NAT64 simultaneously
            
    1.6 Application Layer Attacks [OR]
    
        1.6.1 Cross-Protocol Application Exploits
            1.6.1.1 Different application behavior over IPv4 vs IPv6
            1.6.1.2 Protocol-specific application vulnerabilities
            1.6.1.3 Authentication bypass through protocol switching
            
        1.6.2 API Exploitation
            1.6.2.1 Socket API differences between IPv4 and IPv6
            1.6.2.2 Address family conversion vulnerabilities
            1.6.2.3 getaddrinfo() behavior exploitation
            
    1.7 Operating System Exploits [OR]
    
        1.7.1 Dual-Stack Implementation Flaws
            1.7.1.1 Kernel vulnerabilities in dual-stack handling
            1.7.1.2 Memory corruption in protocol transition code
            1.7.1.3 Race conditions between IPv4 and IPv6 paths
            
        1.7.2 Stack Preference Vulnerabilities
            1.7.2.1 OS-specific protocol selection algorithms
            1.7.2.2 Source address selection vulnerabilities
            1.7.2.3 Route table manipulation across protocols
            
    1.8 Network Infrastructure Attacks [OR]
    
        1.8.1 Router and Switch Exploitation
            1.8.1.1 Dual-stack control plane attacks
            1.8.1.2 Memory exhaustion on network devices
            1.8.1.3 CPU overload from processing both protocols
            
        1.8.2 Load Balancer Attacks
            1.8.2.1 Protocol-specific load balancing bypass
            1.8.2.2 Persistence mechanism manipulation
            1.8.2.3 Health check exploitation across protocols
            
    1.9 Cloud and Virtualization [OR]
    
        1.9.1 Multi-Protocol SDN Exploits
            1.9.1.1 Controller manipulation through either protocol
            1.9.1.2 Flow rule conflicts between IPv4 and IPv6
            1.9.1.3 Virtual switch double-stack vulnerabilities
            
        1.9.2 Cloud Provider Specific Attacks
            1.9.2.1 Exploiting differences in cloud IPv4 vs IPv6 implementation
            1.9.2.2 Bypassing cloud security groups through protocol selection
            1.9.2.3 Cross-protocol attacks in multi-tenant environments
            
    1.10 Advanced Persistence [OR]
    
        1.10.1 Cross-Protocol C2 Channels
            1.10.1.1 Using both protocols for redundant command channels
            1.10.1.2 Protocol switching to evade detection
            1.10.1.3 IPv6 for persistence where IPv4 is monitored
            
        1.10.2 Double Stack Backdoors
            1.10.2.1 Maintaining access through both protocol paths
            1.10.2.2 Fallback mechanisms using alternative protocol
            1.10.2.3 Cross-protocol wake-up mechanisms

policy-map DUAL-STACK-COPP
 class IPv4-CONTROL
  police cir 8000
 class IPv6-CONTROL
  police cir 8000