wpad abuse

🛰️ WPAD Abuse

---

🧠 Overview

The WPAD Abuse module exploits the Web Proxy Auto-Discovery Protocol (WPAD) to capture NTLMv2 authentication hashes.

When a device tries to auto-discover a proxy (via wpad.dat), the Cardputer answers with a malicious proxy configuration. If the device authenticates, the hash is intercepted and stored.

---

⚙️ How It Works

• 🛜 Starts a wifi network
• 📡 Starts a fake DNS server (port 53)
• 🌐 Runs a HTTP server (port 80)
• 📝 Serves wpad.dat (PAC file)
• 🔐 Captures NTLMv2 hashes when clients attempt authentication

---

📁 Involved Files

Path	Purpose
(firmware) wpad.dat	PAC served directly from hardcoded value
/evil/NTLM/ntlm_hashes.txt	Captured NTLMv2 hashes (Hashcat-style lines)

---

✳️ used wpad.dat

function FindProxyForURL(url, host) {
    return "PROXY 192.168.4.1:80; DIRECT";
}

---

🚀 How to Use

1. Boot your Evil-Cardputer
2. Select WPAD Abuse from the main menu
3. A WiFi is started waiting for client
4. Wait for a connected clients to request wpad.dat
5. Captured NTLMv2 hashes are saved automatically to SD
6. Press BACKSPACE to exit and return to the menu

💡 Tip: Combine with Rogue DHCP AP to increase capture chances by sending a 252 option trough DHCP.

---

🖥️ On-Screen Feedback

• ✅ NTLMv2 counter increases when new hash is captured
• 👤 Last user/domain/client displayed
• 📡 Radar-style animation while waiting
• 🔙 Press BACKSPACE to stop

---

🧼 Cleanup

• Use the menu Clean NTLMv2 duplicate to remove duplicates
• Or manually clear /evil/ntlm_hashes.txt

---

📎 Tips & Recommendations

• Works best in AP mode with DNS hijack
• Most effective on Windows with auto proxy enabled
• Some applications can trigger the NTLMv2 authentification (Teams/Outlook/TeamViewer/etc)
• ⚠️ Some clients (e.g., Firefox) ignore WPAD by default
• ⚠️ If the client never used NTLMv2 before, it should send a NTLMv2 without user which is uncrackable, these are filtered

---

---

🔒 Ethical Notice

This module is strictly for authorized penetration testing, research, and educational purposes.
Unauthorized use may break the law.

---

📚 References

• IETF Draft – WPAD (Section 4.4.1)
• Microsoft Open Specifications – MS-GRVHENC
• Microsoft – WPAD Autodiscovery
• Wikipedia – WPAD

---