MITM/WPAD - Revision history

Unknown user: Admin moved page Man in the Middle/WPAD to MITM/WPAD

2022-03-05T20:40:04Z

Admin moved page Man in the Middle/WPAD to MITM/WPAD

← Older revision	Revision as of 20:40, 5 March 2022
(No difference)

Admin: /* What is it? */

2016-08-23T07:52:01Z

What is it?

← Older revision		Revision as of 07:52, 23 August 2016
Line 6:		Line 6:

	In the end, the sheep's browser has asked for, and received, an IP address for what it thinks is a trusted web proxy on a trusted network. However, the web proxy is actually controlled by the attacker. Thus, the sheep's browser is now willingly passing all of its traffic through this hostile proxy server.		In the end, the sheep's browser has asked for, and received, an IP address for what it thinks is a trusted web proxy on a trusted network. However, the web proxy is actually controlled by the attacker. Thus, the sheep's browser is now willingly passing all of its traffic through this hostile proxy server.

			==Tools==

	The [[MITMf]] (man in the middle framework) is capable of doing this: https://github.com/byt3bl33d3r/MITMf		The [[MITMf]] (man in the middle framework) is capable of doing this: https://github.com/byt3bl33d3r/MITMf

Admin at 07:35, 23 August 2016

2016-08-23T07:35:23Z

← Older revision		Revision as of 07:35, 23 August 2016
Line 4:		Line 4:

	To add additional maliciousness, you can ask the user to re-enter their network credentials, and then store those.		To add additional maliciousness, you can ask the user to re-enter their network credentials, and then store those.

			In the end, the sheep's browser has asked for, and received, an IP address for what it thinks is a trusted web proxy on a trusted network. However, the web proxy is actually controlled by the attacker. Thus, the sheep's browser is now willingly passing all of its traffic through this hostile proxy server.

	The [[MITMf]] (man in the middle framework) is capable of doing this: https://github.com/byt3bl33d3r/MITMf		The [[MITMf]] (man in the middle framework) is capable of doing this: https://github.com/byt3bl33d3r/MITMf

Admin at 07:34, 23 August 2016

2016-08-23T07:34:03Z

← Older revision		Revision as of 07:34, 23 August 2016
Line 1:		Line 1:
			==What is it?==

	WPAD is an Internet Explorer vulnerability in the way that IE searches for a proxy server. When IE is set to auto-detect proxy settings, it sends out a request for a server named WPAD to ask for a proxy server IP address. A malicious attacker can set up their own proxy server, and listen for that WPAD request. When the request comes in, the attacker responds with the fake proxy's IP address.		WPAD is an Internet Explorer vulnerability in the way that IE searches for a proxy server. When IE is set to auto-detect proxy settings, it sends out a request for a server named WPAD to ask for a proxy server IP address. A malicious attacker can set up their own proxy server, and listen for that WPAD request. When the request comes in, the attacker responds with the fake proxy's IP address.

Line 4:		Line 6:

	The [[MITMf]] (man in the middle framework) is capable of doing this: https://github.com/byt3bl33d3r/MITMf		The [[MITMf]] (man in the middle framework) is capable of doing this: https://github.com/byt3bl33d3r/MITMf

			==Flags==

			{{MITMFlag}}

Admin: Created page with "WPAD is an Internet Explorer vulnerability in the way that IE searches for a proxy server. When IE is set to auto-detect proxy settings, it sends out a request for a server na..."

2016-08-23T07:33:41Z

Created page with "WPAD is an Internet Explorer vulnerability in the way that IE searches for a proxy server. When IE is set to auto-detect proxy settings, it sends out a request for a server na..."

New page

WPAD is an Internet Explorer vulnerability in the way that IE searches for a proxy server. When IE is set to auto-detect proxy settings, it sends out a request for a server named WPAD to ask for a proxy server IP address. A malicious attacker can set up their own proxy server, and listen for that WPAD request. When the request comes in, the attacker responds with the fake proxy's IP address.

To add additional maliciousness, you can ask the user to re-enter their network credentials, and then store those.

The [[MITMf]] (man in the middle framework) is capable of doing this: https://github.com/byt3bl33d3r/MITMf