BadWPAD
summary
WPAD auto‑proxy resolution still leaks worldwide and is exploitable: a honeypot built with Apache on AWS collects WPAD fetches from airports, hotel hotspots, conference Wi‑Fi and in‑flight networks; initial test of wpad.to yields ~30,000 hits (≈4,500 unique IPs) in one night, expanding to 79 million requests and ~500,000 unique IPs across many TLDs; many requests have empty user‑agents, some domains (eg wpad.tokyo) attract government exit‑points, and several registrants serve mutable proxy.pac files that can target users by source IP.
AI-written summary · about
chapters (18)
- 0:00Intro
- 0:38Welcome
- 2:14DHCP
- 2:58DNS
- 5:20Request
- 5:47Experiments
- 8:42Statistics
- 9:05Main Name
- 13:45Domain Names
- 14:32Company Runs
- 15:53Main Names
- 16:16Honeypot
- 16:35User Agents
- 17:44New TLDs
- 19:25Tokyo
- 19:52Traffic
- 21:01Government of Tokyo
- 21:43Hardware
related talks
44mManna from Heaven: Improving the State of Wireless Rogue AP Attacks
52mWi-Fi Hacking for Web Pentesters
22mAPT Attribution and DNS Profiling
22mPWA as a new Cyber Attack Vector
47mReversing Engineering a Web Application - For Fun, Behavior & WAF Detection
34mWajam: From a Start-up to Massive Spread Adware
01h 04mServer-Side Browsing Considered Harmful
17mWPSE: Fortifying Web Protocols via Browser-Side Security Monitoring