Web Proxy Autodiscovery Protocol

This article may require cleanup to meet Wikipedia's quality standards. No cleanup reason specified. Please add a |reason= parameter to this template. Please help improve this article if you can. The talk page may contain suggestions. (October 2007)

This article is in a list format that may be better presented using prose. You can help by converting this article to prose, if appropriate. Editing help is available. (November 2011)

The Web Proxy Auto-Discovery Protocol (WPAD) is a method used by clients to locate a URL of a configuration file using DHCP and/or DNS discovery methods. Once detection and download of the configuration file is complete it can be executed to determine the proxy for a specified URL. The WPAD protocol only outlines the mechanism for discovering the location of this file, but the most commonly deployed configuration file format is the Proxy auto-config format originally designed by Netscape in 1996 for Netscape Navigator 2.0.^[1] The WPAD protocol was drafted by a consortium of companies including Inktomi Corporation, Microsoft Corporation, RealNetworks, Inc., and Sun Microsystems, Inc.. WPAD is documented in an INTERNET-DRAFT which expired in December 1999.^[2] However WPAD is still supported by all major browsers.^[3][4] WPAD was first included with Internet Explorer 5.0.

Context

In order for all browsers in an organization to be supplied the same proxy policy, without configuring each browser manually, both the below technologies are required:

• Proxy auto-config (PAC) standard: create and publish one central proxy configuration file. Details are discussed in a separate article.
• Web Proxy Autodiscovery Protocol (WPAD) standard: ensure that an organization's browsers will find this file without manual configuration. This is the topic of this article.

The WPAD standard defines two alternative methods the system administrator can use to publish the location of the proxy configuration file, using the Dynamic Host Configuration Protocol (DHCP) or the Domain Name System (DNS):

Before fetching its first page, a web browser implementing this method sends the local DHCP server a DHCPINFORM query, and uses the URL from the WPAD option in the server's reply. If the DHCP server does not provide the desired information, DNS is used. If, for example, the network name of the user's computer is pc.department.branch.example.com, the browser will try the following URLs in turn until it finds a proxy configuration file within the domain of the client:

• http://wpad.department.branch.example.com/wpad.dat
• http://wpad.branch.example.com/wpad.dat
• http://wpad.example.com/wpad.dat
• http://wpad.com/wpad.dat (in incorrect implementations, see note in Security below)

(Note: These are examples and may not be live URLs.)

Notes

• DHCP has a higher priority than DNS: if DHCP provides the WPAD URL, no DNS lookup is performed. Notice that Firefox does not support DHCP, only DNS, and the same is true for Chrome on platforms other than Windows and for versions of Chrome older than version 13.^[5][6]
• DNS lookup removes the first part of the domain name (the client host name) and replaces it with wpad. Then, it "moves up" in the hierarchy by removing more parts of the domain name, until it finds a WPAD PAC file or leaves the current organisation.
• The browser guesses where the organisation boundaries are. The guess is often right for domains like 'company.com' or 'university.edu', but wrong for 'company.co.uk' (see security below).
• For DNS lookups, the path of the configuration file is always wpad.dat. For the DHCP protocol, any URL is usable. For traditional reasons, PAC files are often called proxy.pac (of course, files with this name will be ignored by the WPAD DNS search).
• The MIME type of the configuration file must be "application/x-ns-proxy-autoconfig". Please read Proxy auto-config for more details.
• Internet Explorer and Konqueror are currently the only browsers offering support for both the DHCP and DNS method, the DNS method is supported by most major browsers.

Requirements

In order for WPAD to work, a few requirements have to be met:

• In order to use DHCP, the server must be configured to serve up the "site-local" option 252 ("auto-proxy-config") with a string value of "http://example.com/wpad.dat" (without the quotes) where "example.com" is the address of a Web server (either an IP address in dotted quad format or a DNS name).
• In order to use the DNS only method, a DNS entry is needed for a host named WPAD.
• The host at the WPAD address must be able to serve a Web page.
• In both cases, the Web server must be configured to serve the WPAD file with a MIME type of "application/x-ns-proxy-autoconfig".
• If the DNS method is used, a file named wpad.dat must be located in the WPAD Web site's root directory.
• The PAC files are discussed in the Proxy auto-config article.
• Use caution when configuring a WPAD server in a virtual hosting environment. When automatic proxy detection is used, WinHTTP and WinINET in Internet Explorer 6 and earlier send a "Host: <IP address>" header and IE7+ and Firefox send a "Host: wpad" header. Therefore, it is recommended that the wpad.dat file be hosted under the default virtual host rather than its own.
• Internet Explorer version 6.0.2900.2180.xpsp_sp2_rtm requests "wpad.da" instead of "wpad.dat" from the Web server.

Security

While greatly simplifying configuration of one organisation's web browsers, the WPAD protocol has to be used with care: simple mistakes can open doors for attackers to change what appears on a user's browser:

• An attacker inside a network can set up a DHCP server that hands out the URL of a malicious PAC script.
• If the network is 'company.co.uk' and the file http://wpad.company.co.uk/wpad.dat isn't served, the browsers will go on to request http://wpad.co.uk/wpad.dat. The browser doesn't determine whether this is still inside the organization. See http://wpad.com/ for an example.
• The same method has been used with http://wpad.org.uk. This used to serve a wpad.dat file that would redirect all of the user's traffic to an internet auction site.
• ISPs that have implemented DNS hijacking can break the DNS lookup of the WPAD protocol by directing users to a host that is not a proxy server.

Through the WPAD file, the attacker can point users' browsers to their own proxies and intercept and modify all of WWW traffic. Although a simplistic fix for Windows WPAD handling was applied in 2005, it only fixed the problem for the .com domain. A presentation at Kiwicon showed that the rest of the world was still critically vulnerable to this security hole, with a sample domain registered in New Zealand for testing purposes receiving proxy requests from all over the country at the rate of several a second.

Thus, an administrator should make sure that a user can trust all the DHCP servers in an organisation and that all possible wpad domains for the organisation are under control. Furthermore, if there's no wpad domain configured for an organisation, a user will go to whatever external location has the next wpad site in the domain hierarchy and use that for its configuration. This allows whoever registers the wpad subdomain in a particular country to perform a man-in-the-middle attack on large portions of that country's internet traffic by setting themselves as a proxy for all traffic or sites of interest.

On top of these traps, the WPAD method fetches a JavaScript file and executes it on all users browsers, even when they have disabled JavaScript for viewing web pages.

References

Further reading

• Jonathan de Boyne Pollard (2004). "Automatic proxy HTTP server configuration in web browsers". Frequently Given Answers. http://homepage.ntlworld.com./jonathan.deboynepollard/FGA/web-browser-auto-proxy-configuration.html. 
• Chris Paget (2007). "WPAD - Attacking the Proxy". http://video.google.com/videoplay?docid=-4596414840866123044. 
• David W. Hankins (2008). "HOWTO: WPAD". http://www.mercenary.net/blog/index.php?/archives/42-HOWTO-WPAD.html. 

External links

• IETF 1999: Web Proxy Auto-Discovery Protocol — Expired internet draft.
• Waikato Linux Users Group Wiki 2004: WPAD
• ProxyPACFiles.com Practical guide to writing and managing proxy PAC files with samples, tips, lessons learned, etc.
• FindProxyForURL.com — A Proxy Auto-Configuration Resources (PAC File & WPAD Examples)
• Proxy configuration notes for Konqueror
• AutoProxy for Windows; Fully Automatic Proxy configuration tool for Internet Explorer and Firefox based on network location profiles (freeware)
• How to configure web proxy autodiscovery in your network - Scenario on how to configure DHCP, DNS and PAC file in a windows network
• Windows 2000 Server Auto-Discovery Setup

v t e Windows Internet Explorer Versions Main 1 2 3 4 5 6 7 8 9 10 Other Mobile for Mac for UNIX IEs4Linux Version Overview Overview History Removal Easter eggs Box model Add-ins Browser Helper Object (BHO) Extensions Shells Technologies MSXML RSS Platform Smart tags JScript DHTML (HTA HTML Components) Vector Markup Language MHTML HTML+TIME XHR/XDomainRequest ActiveX WPAD Temporary Internet Files Index.dat favicon.ico Web Slice Accelerator Software & Engines Administration Kit Developer Tools Integrated Windows Authentication Tasman Trident (Chakra) Implementations Outlook Express Internet Mail and News Comic Chat/Chat 2.0 NetMeeting NetShow ActiveMovie DirectX Media Windows Address Book Windows Desktop Update Active Desktop Active Channel Channel Definition Format (.cdf) Microsoft Java Virtual Machine (MSJVM) Server Gated Cryptography (SGC) MSN Explorer MSN for Mac OS X Spyglass Events First browser war United States v. Microsoft Sun v. Microsoft Download.ject Eolas v. Microsoft Second browser war People Dean Hachamovitch Scott Isaacs Tantek Çelik Web browsers timeline comparison usage list

v t e Web browsers Comparison History List (for Unix) Timeline Usage share Features Ad filtering Augmented browsing Download manager Cookies Favicon Incremental search Bookmarks (Bookmarklet Live bookmark Smart Bookmark) Browser security Privacy mode Browser synchronizer (comparison) Tabbed browsing Universal Edit Button Plugin Extension Web standards Acid tests Cascading Style Sheets HTML HTML5 OCSP SVG XHTML WebGL JavaScript MathML Related topics World Wide Web Widget Rich Internet application Site-specific browser Internet suite Mobile Web Offline reader BrowserChoice.eu Pwn2Own iLoo Man-in-the-browser WPAD PAC SPDY HTTP HTTPS SSL/TLS WebSocket XML CRL   Desktop Trident-based AOL Explorer Avant Conqueror Browser Deepnet Explorer GreenBrowser Lunascape Maxthon MenuBox NeoPlanet NetCaptor Internet Explorer MediaBrowser Sleipnir SlimBrowser SpaceTime UltraBrowser WebbIE ZAC Browser Gecko-based AT&T Pogo Avant Beonex Communicator Camino Classilla Conkeror Epic Firefox Flock (versions before 3.0) Galeon Ghostzilla GNU IceCat K-Meleon Kazehakase Kirix Strata Lotus Symphony Lunascape Mozilla Netscape Pale Moon SeaMonkey Sleipnir Swiftfox Swiftweasel TenFourFox Timberwolf xB Browser WebKit-based or KHTML-based Arora Avant Chrome Chromium Dragon Dooble Flock (version 3.0+) Fluid iCab Konqueror Lunascape Maxthon Midori OmniWeb Origyn Web Browser QupZilla rekonq RockMelt Safari Shiira Sputnik SRWare Iron Uzbl Web WebPositive xxxterm Presto-based Opera Text-based ELinks Emacs/W3 Line Mode Browser Links Lynx Net-Tamer w3m Other abaco Amaya Arachne Arena Charon Dillo EGBrowser Gazelle IBM Home Page Reader IBrowse KidZui Mosaic-CK Mothra NetPositive NetSurf Oregano VMS Mosaic   Mobile WebKit-based Android Browser Chrome Dolphin Browser S60 web browser Safari Silk Nintendo 3DS Internet Browser Steel BOLT Presto-based Nintendo DS & DSi Browser Opera Mini Opera Mobile Gecko-based Firefox for mobile MicroB Minimo Other Blazer Deepfish Galio ibisBrowser Internet Explorer Mobile Iris Browser JOCA Konqueror Embedded NetFront Obigo Browser Skweezer Skyfire Teashark ThunderHawk UC Browser uZard Web Vision WinWAP   Television and video game console WebKit-based Google TV NetFront Steam overlay Presto-based Internet Channel Gecko-based Kylo Other Galio MSN TV (WebTV) Software no longer in development shown in italics Category  Commons