WPAD (Web Proxy Auto Discovery) is a method used by web clients to automatically locate a browser configuration file used to connect through a proxy. Successful attacks on WPAD guarantees attackers full access on user data sent to the Internet which could allow theft of critical data like passwords or credit card numbers. WPAD potential danger depends on two factors: default configuration and weak awareness among users. In this article they discuss WPAD architecture and its many functioning principles in home and corporate networks, real examples of attacks and give recommendations for ordinary users and system administrators that allow reducing attack consequences.
