5

If you are in a Windows network, and you basically connect to a website ; And there is an attacker on Linux who changes the hostname to WPAD and configures WPAD.dat in his system, all your PC's traffic can be captured (or) spoofed.

WPAD.dat - Something like:

function FindProxyForUrl(url, h){

    return "FAKE PROXY";

}
4

As a client device, simply turn off the "Automatically detect proxy settings" feature in Internet Options. This prevents the browser from trying to look up a location for the wpad.dat or proxy PAC script.

If you want to protect poorly configured devices on your network, set a DNS entry for WPAD and blackhole the traffic.

| improve this answer | |
1

A DNS entry to 127.0.0.1 is only helpful if the computer is inside a corporate network. In a home environment or at a public wireless site you have to rely on the browsers "Automatically detect proxy settings." If the browser has been re-installed or a new one installed the settings Proxy settings may still be turned on. To protect the system, put an entry for WPAD in the C:\Windows\System32\drivers\etc\hosts file.

EG: 127.0.0.1 WPAD

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.