Why Are You Still Using My Server for Your Internet Access?
Details a year-long investigation running eight wpad.tld domains that received over one billion DNS requests and enabled unauthenticated traffic interception.
Summary
The 25-Year-Old WPAD Design Flaw
Web Proxy Auto-Discovery (WPAD) allows client operating systems to automatically discover and configure proxy servers. However, legacy queries falling back to top-level domains create severe interception vulnerabilities.
Registering Top Level WPAD Domains
Researchers registered eight distinct wpad.tld domains and monitored incoming DNS queries over a twelve-month observation period.
Harvesting One Billion DNS Requests
The infrastructure captured over one billion DNS lookups and six hundred gigabytes of Apache web server logs containing sensitive client credentials and internal network metadata.
Executing Man-in-the-Middle Traps
Because clients automatically accept downloaded proxy configuration scripts, attackers controlling these domains can establish man-in-the-middle proxies, decrypt traffic, and serve arbitrary malicious payloads.
Related talks
Main Stage·30 min
Matthew Bryant
Investigation into enterprise and government IT assets sold on public marketplaces containing unencrypted data and sensitive firmware.
Recon Village·19 min
Utku Sen
Utku Sen reveals how brute forcing and analyzing short URL endpoints leaks confidential cloud documents, private tokens, and unindexed internal infrastructure.
War Stories·21 min
Lorenzo Cococcia
Lorenzo Cococcia explores offensive physical geolocation, using network latency trilateration across distributed sensors to locate adversary C2 servers.