Web Proxy Auto-Discovery Protocol

WPAD operates by having a client attempt to discover a proxy auto-config (PAC) file, typically named wpad.dat, using a two-step process. First, the client queries the network's DHCP server for a WPAD option (option 252) that provides the URL of the PAC file. If that fails, the client falls back to DNS: it appends wpad to the local domain name and then tries progressively shorter domain suffixes (e.g., wpad.example.com, then wpad.com) until a server responds. The client then fetches the PAC file via HTTP and executes its JavaScript logic to determine the proxy for each request.¹

WPAD introduces significant security risks because it relies on unauthenticated, unencrypted discovery and file retrieval. An attacker on the same network can respond to DHCP or DNS queries with a malicious PAC file, redirecting traffic through a rogue proxy and enabling man-in-the-middle attacks, credential theft, or content injection. This is especially dangerous on public Wi-Fi networks. Additionally, the DNS fallback method can be exploited via domain name collisions, where an attacker registers a domain like wpad.com and serves a malicious file to clients that fail to find a local WPAD server. Because WPAD is enabled by default in many systems, administrators often disable it or use Group Policy to enforce secure proxy settings.

WPAD is supported by all major operating systems, including Windows, macOS, and Linux, as well as by web browsers like Internet Explorer, Firefox, and Chrome. In Windows, WPAD is part of the WinHTTP and WinINET stacks, and it can be configured via the registry or Group Policy. Many enterprise networks deploy WPAD to simplify proxy configuration for thousands of clients, but they typically secure it by using DHCP option 252 with a known URL and by restricting DNS responses. The protocol is also used in some non-browser contexts, such as email clients and system update services, to route traffic through a proxy.²

WPAD has a few obscure details. The PAC file format is actually JavaScript, and it can include functions like FindProxyForURL that return proxy strings. The protocol was never standardized as an RFC; it remains an Internet-Draft, which has led to inconsistent implementations. Some early versions of WPAD used a different filename, wspad.dat, but it was quickly deprecated. Also, WPAD can be used with IPv6, but the DHCPv6 option for WPAD is not widely implemented. In 2016, a researcher demonstrated a global WPAD attack by registering wpad.com and wpad.net, affecting millions of users, which prompted browser vendors to change their default behavior.

PAC file

Proxy auto-config file, a JavaScript file that defines how a client chooses a proxy for a given URL.

DHCP

Dynamic Host Configuration Protocol, used to assign IP addresses and other network parameters.

Man-in-the-middle attack

An attack where the attacker secretly intercepts and relays communication between two parties.