Web Proxy Auto-Discovery Protocol


The Web Proxy Auto-Discovery Protocol is a method used by clients to locate the URL of a configuration file using DHCP and/or DNS discovery methods. Once detection and download of the configuration file is complete, it can be executed to determine the proxy for a specified URL.

History

The WPAD protocol only outlines the mechanism for discovering the location of this file, but the most commonly deployed configuration file format is the proxy auto-config format originally designed by Netscape in 1996 for Netscape Navigator 2.0.
The WPAD protocol was drafted by a consortium of companies including Inktomi Corporation, Microsoft Corporation, RealNetworks, Inc., and Sun Microsystems, Inc.. WPAD is documented in an INTERNET-DRAFT which expired in December 1999. However, WPAD is still supported by all major browsers. WPAD was first included with Internet Explorer 5.0.

Context

In order for all browsers in an organization to be supplied the same proxy policy, without configuring each browser manually, both the below technologies are required:
  • Proxy auto-config standard: create and publish one central proxy configuration file. Details are discussed in a separate article.
  • Web Proxy Auto-Discovery Protocol standard: ensure that an organization's browsers will find this file without manual configuration. This is the topic of this article.
The WPAD standard defines two alternative methods the system administrator can use to publish the location of the proxy configuration file, using the Dynamic Host Configuration Protocol or the Domain Name System :
Before fetching its first page, a web browser implementing this method sends a DHCPINFORM query to the local DHCP server, and uses the URL from the WPAD option in the server's reply. If the DHCP server does not provide the desired information, DNS is used. If, for example, the network name of the user's computer is pc.department.branch.example.com, the browser will try the following URLs in turn until it finds a proxy configuration file within the domain of the client:
  • http://wpad.department.branch.example.com/wpad.dat
  • http://wpad.branch.example.com/wpad.dat
  • http://wpad.example.com/wpad.dat
  • http://wpad.com/wpad.dat
Additionally on Windows if the DNS query is unsuccessful then Link-Local Multicast Name Resolution and/or NetBIOS will be used.

Requirements

In order for WPAD to work, a few requirements have to be met:
  • In order to use DHCP, the server must be configured to serve up the "site-local" option 252 with a string value of e.g. http://example.com/wpad.dat where "example.com" is the address of a Web server.
  • In order to use the DNS only method, a DNS entry is needed for a host named WPAD.
  • The host at the WPAD address must be able to serve a Web page.
  • In both cases, the Web server must be configured to serve the WPAD file with a MIME type of application/x-ns-proxy-autoconfig.
  • If the DNS method is used, a file named wpad.dat must be located in the WPAD Web site's root directory.
  • The PAC files are discussed in the Proxy auto-config article.
  • Use caution when configuring a WPAD server in a virtual hosting environment. When automatic proxy detection is used, WinHTTP and WinINET in Internet Explorer 6 and earlier send a "Host: " header and IE7+ and Firefox sends a "Host: wpad" header. Therefore, it is recommended that the wpad.dat file be hosted under the default virtual host rather than its own.
  • Internet Explorer version 6.0.2900.2180.xpsp_sp2_rtm requests "wpad.da" instead of "wpad.dat" from the Web server.
  • If Windows Server 2003 is used as the DNS server, the DNS Server Global Query Block List may have to be disabled, or the registry can be modified to edit the list of blocked queries.

    Security

While greatly simplifying configuration of one organisation's web browsers, the WPAD protocol has to be used with care: simple mistakes can open doors for attackers to change what appears on a user's browser:
  • An attacker inside a network can set up a DHCP server that hands out the URL of a malicious PAC script.
  • If the network is 'company.co.uk' and the file http://wpad.company.co.uk/wpad.dat isn't served, the browsers will go on to request http://wpad.co.uk/wpad.dat. Before the introduction of the Public Suffix List in the 2010s, some browsers could not determine that wpad.co.uk was no longer inside the organization.
  • The same method has been used with http://wpad.org.uk. This used to serve a wpad.dat file that would redirect all of the user's traffic to an internet auction site.
  • ISPs that have implemented DNS hijacking can break the DNS lookup of the WPAD protocol by directing users to a host that is not a proxy server.
  • Leaked WPAD queries could result in domain name collisions with internal network naming schemes. If an attacker registers a domain to answer leaked WPAD queries and configures a valid proxy, there is potential to conduct man-in-the-middle attacks across the Internet.
Through the WPAD file, the attacker can point users' browsers to their own proxies and intercept and modify the WWW traffic of everyone connected to the network. Although a simplistic fix for Windows WPAD handling was applied in 2005, it only fixed the problem for the.com domain. A presentation at Kiwicon showed that the rest of the world was still critically vulnerable to this security hole, with a sample domain registered in New Zealand for testing purposes receiving proxy requests from all over the country at the rate of several a second. Several of the wpad.tld domain names now point to the client loopback address to help protect against this vulnerability, though some names are still registered.
Thus, an administrator should make sure that a user can trust all the DHCP servers in an organisation and that all possible wpad domains for the organisation are under control. Furthermore, if there's no wpad domain configured for an organisation, a user will go to whatever external location has the next wpad site in the domain hierarchy and use that for its configuration. This allows whoever registers the wpad subdomain in a particular country to perform a man-in-the-middle attack on large portions of that country's internet traffic by setting themselves as a proxy for all traffic or sites of interest.
On top of these traps, the WPAD method fetches a JavaScript file and executes it on all users browsers, even when they have disabled JavaScript for viewing web pages.