As part of configuring a large number of systems within a network, the Proxy-Auto Configuration (PAC) file is used to have a common configuration. This is done by using the feature called Web Proxy Auto Discovery (WPAD) that helps the browser to determine the available PAC file. PAC file path is configured in DHCP servers. The attacker impersonates as the DHCP server and provides the malicious PAC file to the user. PAC file determines the proxy server to be used for a particular Uniform Resource Locator (URL). Attacker has to be on the same network as the victim or able to spoof DHCP response packets. The PAC file is retrieved from the attacker web server. The attacker replaces the PAC file with malicious PAC file that can redirect traffic to the attacker IP address. Victim is redirected to the attacker controlled proxy server. The attacker is able to view the URL the victim visits. This is performed before a secure connection is established between the client and the web server. This attack can be mitigated by using a technique called DHCP snooping in switches that can verify DHCP messages passing through the switch that prevents impersonation of DHCP server. © 2017, Springer Nature Singapore Pte Ltd.
cited By 0; Conference of 5th International Symposium on Security in Computing and Communications, SSCC 2017 ; Conference Date: 13 September 2017 Through 16 September 2017; Conference Code:204689
K. R. Atul and Jevitha, K. P., “Prevention of PAC File Based Attack Using DHCP Snooping”, Communications in Computer and Information Science, vol. 746, pp. 195-204, 2017.