The Web Proxy Auto-Discovery (WPAD) Protocol is a method used by clients to locate the URL of a configuration file using
DHCP
The Dynamic Host Configuration Protocol (DHCP) is a network management protocol used on Internet Protocol (IP) networks for automatically assigning IP addresses and other communication parameters to devices connected to the network using a cli ...
and/or
DNS
The Domain Name System (DNS) is a hierarchical and distributed naming system for computers, services, and other resources in the Internet or other Internet Protocol (IP) networks. It associates various information with domain names assigned to ...
discovery methods. Once detection and download of the configuration file is complete, it can be executed to determine the proxy for a specified URL.
History
The WPAD protocol only outlines the mechanism for discovering the location of this file, but the most commonly deployed configuration file format is the
proxy auto-config format originally designed by
Netscape
Netscape Communications Corporation (originally Mosaic Communications Corporation) was an American independent computer services company with headquarters in Mountain View, California and then Dulles, Virginia. Its Netscape web browser was onc ...
in 1996 for
Netscape Navigator 2.0.
The WPAD protocol was drafted by a consortium of companies including
Inktomi Corporation
Inktomi Corporation was a company that provided software for Internet service providers (ISPs). It was incorporated in Delaware and headquartered in Foster City, California, United States. Customers included Microsoft, HotBot, Amazon.com, eBay, ...
,
Microsoft Corporation
Microsoft Corporation is an American multinational corporation, multinational technology company, technology corporation producing Software, computer software, consumer electronics, personal computers, and related services headquartered at th ...
,
RealNetworks, Inc., and
Sun Microsystems, Inc.
Sun Microsystems, Inc. (Sun for short) was an American technology company that sold computers, computer components, software, and information technology services and created the Java (programming language), Java programming language, the Solari ...
(now
Oracle Corp.). WPAD is documented in an INTERNET-DRAFT which expired in December 1999. However, WPAD is still supported by all major browsers.
WPAD was first included with
Internet Explorer 5.0
Microsoft Internet Explorer 5 (IE5) is a graphical web browser, the fifth version of Internet Explorer, the successor to Internet Explorer 4 and one of the main participants of the first browser war. Its distribution methods and Windows integrat ...
.
Context
In order for all browsers in an organization to be supplied the same proxy policy, without configuring each browser manually, both the below technologies are required:
*
Proxy auto-config (PAC) standard: create and publish one central proxy configuration file. Details are discussed in a separate article.
* Web Proxy Auto-Discovery Protocol (WPAD) standard: ensure that an organization's browsers will find this file without manual configuration. This is the topic of this article.
The WPAD standard defines two alternative methods the system administrator can use to publish the location of the proxy configuration file, using the
Dynamic Host Configuration Protocol
The Dynamic Host Configuration Protocol (DHCP) is a network management protocol used on Internet Protocol (IP) networks for automatically assigning IP addresses and other communication parameters to devices connected to the network using a cli ...
(DHCP) or the
Domain Name System
The Domain Name System (DNS) is a hierarchical and distributed naming system for computers, services, and other resources in the Internet or other Internet Protocol (IP) networks. It associates various information with domain names assigned to ...
(DNS):
Before fetching its first page, a
web browser
A web browser is application software for accessing websites. When a user requests a web page from a particular website, the browser retrieves its files from a web server and then displays the page on the user's screen. Browsers are used on ...
implementing this method sends a DHCPINFORM query to the local DHCP server, and uses the URL from the WPAD option in the server's reply. If the DHCP server does not provide the desired information, DNS is used. If, for example, the network name of the user's computer is ''pc.department.branch.example.com'', the browser will try the following URLs in turn until it finds a proxy configuration file within the domain of the client:
*
http://wpad.department.branch.example.com/wpad.dat
*
http://wpad.branch.example.com/wpad.dat
*
http://wpad.example.com/wpad.dat
*
http://wpad.com/wpad.dat (in incorrect implementations, see note in Security below)
(Note: These are examples and are not "live" URLs due to them employing the reserved domain name of "
example.com
The domain names example.com, example.net, example.org, and example.edu are second-level domain names in the Domain Name System of the Internet. They are reserved by the Internet Assigned Numbers Authority (IANA) at the direction of the Internet ...
".)
Additionally on Windows if the DNS query is unsuccessful then
Link-Local Multicast Name Resolution (LLMNR) and/or
NetBIOS
NetBIOS () is an acronym for Network Basic Input/Output System. It provides services related to the session layer of the OSI model allowing applications on separate computers to communicate over a local area network. As strictly an API, NetB ...
will be used.
Notes
DHCP has a higher priority than DNS: if DHCP provides the WPAD URL, no DNS lookup is performed. This only works with DHCPv4. In DHCPv6, there is no WPAD-Option defined.
Notice that Firefox does not support DHCP, only DNS, and the same is true for Chrome on platforms other than Windows and ChromeOS, and for versions of Chrome older than version 13.
When constructing the query packet, DNS lookup removes the first part of the domain name (the client host name) and replaces it with ''wpad''. Then, it "moves up" in the hierarchy by removing more parts of the domain name, until it finds a WPAD PAC file or leaves the current organisation.
The browser guesses where the organisation boundaries are. The guess is often right for domains like 'company.com' or 'university.edu', but wrong for 'company.co.uk' (see security below).
For DNS lookups, the path of the configuration file is always ''wpad.dat''. For the DHCP protocol, any URL is usable. For traditional reasons, PAC files are often called ''proxy.pac'' (of course, files with this name will be ignored by the WPAD DNS search).
The
MIME type
A media type (also known as a MIME type) is a two-part identifier for file formats and format contents transmitted on the Internet. The Internet Assigned Numbers Authority, Internet Assigned Numbers Authority (IANA) is the official authority for t ...
of the configuration file must be "application/x-ns-proxy-autoconfig". See
Proxy auto-config for more details.
Internet Explorer and
Konqueror
Konqueror is a free and open-source web browser and file manager that provides web access and file-viewer functionality for file systems (such as local files, files on a remote FTP server and files in a disk image). It forms a core part of ...
are currently the only browsers offering support for both the DHCP and DNS methods; the DNS method is supported by most major browsers.
Requirements
In order for WPAD to work, a few requirements have to be met:
* In order to use DHCP, the server must be configured to serve up the "site-local" option 252 ("auto-proxy-config") with a string value of e.g.
http://example.com/wpad.dat where "example.com" is the address of a Web server.
* In order to use the DNS only method, a DNS entry is needed for a host named WPAD.
* The host at the WPAD address must be able to serve a
Web page.
* In both cases, the Web server must be configured to serve the WPAD file with a
MIME type
A media type (also known as a MIME type) is a two-part identifier for file formats and format contents transmitted on the Internet. The Internet Assigned Numbers Authority, Internet Assigned Numbers Authority (IANA) is the official authority for t ...
of
application/x-ns-proxy-autoconfig
.
* If the DNS method is used, a file named ''wpad.dat'' must be located in the WPAD Web site's
root directory
In a computer file system, and primarily used in the Unix and Unix-like operating systems, the root directory is the first or top-most directory in a hierarchy. It can be likened to the trunk of a tree, as the starting point where all branches ...
.
* The PAC files are discussed in the
Proxy auto-config article.
* Use caution when configuring a WPAD server in a
virtual hosting
Virtual hosting is a method for hosting multiple domain names (with separate handling of each name) on a single server (or pool of servers). This allows one server to share its resources, such as memory and processor cycles, without requiring all ...
environment. When automatic proxy detection is used, WinHTTP and WinINET in Internet Explorer 6 and earlier send a "Host:
" header and IE7+ and Firefox sends a "Host: wpad" header. Therefore, it is recommended that the wpad.dat file be hosted under the default virtual host rather than its own.
* Internet Explorer version 6.0.2900.2180.xpsp_sp2_rtm requests "wpad.da" instead of "wpad.dat" from the Web server.
* If you are using Windows Server 2003 (or later) as your DNS server, you might have to disable the ''DNS Server Global Query Block List'', or even modify the registry to edit the list of blocked queries.
Security
While greatly simplifying configuration of one organisation's web browsers, the WPAD protocol has to be used with care: simple mistakes can open doors for attackers to change what appears on a user's browser:
* An attacker inside a network can set up a DHCP server that hands out the URL of a malicious PAC script.
* If the network is 'company.co.uk' and the file http://wpad.company.co.uk/wpad.dat isn't served, the browsers will go on to request http://wpad.co.uk/wpad.dat. Before the introduction of the Public Suffix List The Public Suffix List (PSL) is a catalog of certain Internet domain names. Entries on the list are also referred to as effective top-level domains (eTLD).
The Mozilla Foundation initiated the suffix list for the security and privacy policies of its ...
in the 2010s, some browsers could not determine that wpad.co.uk was no longer inside the organization.
* The same method has been used with http://wpad.org.uk. This used to serve a wpad.dat file that would redirect all of the user's traffic to an internet auction site.
* ISPs that have implemented DNS hijacking
DNS hijacking, DNS poisoning, or DNS redirection is the practice of subverting the resolution of Domain Name System (DNS) queries. This can be achieved by malware that overrides a computer's TCP/IP configuration to point at a rogue DNS server unde ...
can break the DNS lookup of the WPAD protocol by directing users to a host that is not a proxy server.
* Leaked WPAD queries could result in domain name collisions with internal network naming schemes. If an attacker registers a domain to answer leaked WPAD queries and configures a valid proxy, there is potential to conduct man-in-the-middle (MitM) attacks across the Internet.[
]
Through the WPAD file, the attacker can point users' browsers to their own proxies and intercept and modify the WWW traffic of everyone connected to the network. Although a simplistic fix for Windows WPAD handling was applied in 2005, it only fixed the problem for the .com domain. A presentation at Kiwicon
Kiwicon is a New Zealand computer security conference held annually in Wellington from 2007. It brings together a variety of people interested in information security. Representatives of government agencies and corporations attend, along with hack ...
showed that the rest of the world was still critically vulnerable to this security hole, with a sample domain registered in New Zealand for testing purposes receiving proxy requests from all over the country at the rate of several a second. Several of the wpad.tld domain names (including COM, NET, ORG, and US) now point to the client loopback address to help protect against this vulnerability, though some names are still registered (wpad.co.uk).
Thus, an administrator should make sure that a user can trust all the DHCP servers in an organisation and that all possible wpad domains for the organisation are under control. Furthermore, if there's no wpad domain configured for an organisation, a user will go to whatever external location has the next wpad site in the domain hierarchy and use that for its configuration. This allows whoever registers the wpad subdomain in a particular country to perform a man-in-the-middle attack
In cryptography and computer security, a man-in-the-middle, monster-in-the-middle, machine-in-the-middle, monkey-in-the-middle, meddler-in-the-middle, manipulator-in-the-middle (MITM), person-in-the-middle (PITM) or adversary-in-the-middle (AiTM) ...
on large portions of that country's internet traffic by setting themselves as a proxy for all traffic or sites of interest.
On top of these traps, the WPAD method fetches a JavaScript file and executes it on all users browsers, even when they have disabled JavaScript for viewing web pages.
References
Further reading
*
*
*
{{Web browsers
Internet Explorer
Web browsers
Proxy servers
Network protocols
Computer configuration
Internet Standards
Domain Name System