The WPAD protocol can in some circumstances allow an attacker to get clients to use a malicious PAC script.
It appears to be well documented, that this can be used to perform MITM-attacks on HTTP traffic. However I don't see any discussion on the impact on HTTPS traffic.
As far as I can tell, it does not permit for a full MITM-attack on the HTTPS traffic since the PAC script can only direct the browser to which proxy to use, but there will still be an end-to-end SSL connection between the client and the legitimate server.
However one of the arguments for the FindProxyForURL
function provided by the attacker is the full URL. Moreover FindProxyForURL
can trigger DNS lookups.
Can an attacker utilize this to leak HTTPS URLs? If not, what protection is in place to prevent such leaks?
FindProxyForURL
function. This is also explained in the link in my question: en.wikipedia.org/wiki/Proxy_auto-config What would stop the script from sending this URL to an attacker?