WPAD proxy discovery

lateral_wpad_request

Resolves the WPAD hostname and requests wpad.dat over HTTP, the automatic-proxy discovery path that lets anyone who answers first become the man in the middle for the whole host.

Severity medium how bad it would be if it were real

Expected outcome Something should prevent it

Platforms 3 macOS, Linux, Windows

Isolation subprocess runs in its own process, so a kill is a measurement

What it needs before it will run

runs in --safe
Observation only. It runs even in the inert mode, because it changes nothing and sends nothing.
sends traffic
Generates outbound traffic. --no-network suppresses it entirely.

Gates are cumulative and none of them is implied by another: see the three gates for why they are separate decisions.

ATT&CK techniques it exercises

MITRE ATT&CK techniques this test maps to.
Technique	Name	Tactic	Across public reports
T1090	Proxy	Command and Control	coverage statistics
T1557.001	LLMNR/NBT-NS Poisoning and SMB Relay	Lateral Movement	coverage statistics

How often anything notices

Not enough data: fewer than 3 public reports have run this test, so no rate is published for it. Groups below that threshold are withheld everywhere on the site — with one or two contributors an average is one organisation's result with a percent sign after it.

Other lateral movement tests

Other tests in the Lateral movement category.
Test	What it does	Severity
Name-resolution poisoner bait lateral_responder_bait	Broadcasts LLMNR, NBT-NS and mDNS queries for a hostname that cannot exist. On a healthy network nothing answers; an answer means a poisoner such as R…	high
Remote administration service probe lateral_service_probe	Connects to the remote-administration ports of neighbouring hosts in the local /24 — SMB, RDP, WinRM, SSH, RPC and VNC — to establish whether this hos…	high
SMB share enumeration without credentials lateral_smb_null_session	Asks neighbouring hosts to list their SMB shares without supplying credentials — the null session that used to be the first step of every intrusion. N…	high

the whole catalogue this test in the list run it yourself

Catalogue generated from client 0.1.0. A test's behaviour can change between releases; this page describes the version named here.