141–150 of 212 posts
Earlier quoted context omitted.
I too wish to join this group
If this group ever convenes in NYC I will find a bar and buy the drinks just to be a fly on the wall.
Most of the stuff is implemented in Go because I believe that you've only understood the problem if you can automate it in code, as you can see in my writeups repo [1] :D
Earlier quoted context omitted.
What archive? The idea was to use Transfer-Encoding: gzip, which means the compression is a transparent part of the HTTP request which the client HTTP library will automatically try to extract.
Unless I misunderstood, there was a gzip transfer encoded gzip. The transfer-encoding means that the proxy has to decompress a 200kb request into a 2Gb response to the client, and the client will receive a 2Gb file that will expand to 20Gb. Small VM gets knocked offline and the proxy gets grumpy with the client for large file transfers.
Yes, correct. A gzip bomb inside a gzip bomb that contains only null bytes, because it's much larger on the client side when unpacked.
A "normal" gzip bomb that would only leverage "Content-Encoding: gzip" or only "Transfer-Encoding: gzip" isn't really good as for compression ratio, because the sent file is in the megabytes range (I think it was around 4MBish when I tried with gzip -9?). I don't wanna send megabytes in response to clients, because that would be a potential DoS.
edit: also note the sibling comment here: https://news.ycombinator.com/item?id=41923635#41936586
First off, make a website defend mode that can be triggered to serve different content. Then, do the following: 1. Add a robots.txt, make it look like it's wordpress (Disallow: /wp-admin etc) 2. If any client requests /wp-admin, flag their IP ASN as bot. 3. If a client is a bot, send it a gzip bomb (100kB size, unpacked around 20GB), use Transfer-Encoding: gzip and Content-Encoding: gzip to also punish malicious web…
Was the Sneed incident real ?
First off, make a website defend mode that can be triggered to serve different content. Then, do the following: 1. Add a robots.txt, make it look like it's wordpress (Disallow: /wp-admin etc) 2. If any client requests /wp-admin, flag their IP ASN as bot. 3. If a client is a bot, send it a gzip bomb (100kB size, unpacked around 20GB), use Transfer-Encoding: gzip and Content-Encoding: gzip to also punish malicious web…
Earlier quoted context omitted.
Yes, it requires the client to try and extract the archive; https://en.wikipedia.org/wiki/Zip_bomb is the generic description.
What archive? The idea was to use Transfer-Encoding: gzip, which means the compression is a transparent part of the HTTP request which the client HTTP library will automatically try to extract.
But that's a good point; I'd not considered that if you compress the HTTP response it'll almost certainly get automatically extracted which "detonates" the (g)zip bomb.
Earlier quoted context omitted.
For some definition of "common", yes. Some try to be less shady by asking for consent (e.g. in exchange for in-game credits), others are essentially malware. For example: https://bright-sdk.com/ > Bright SDK is approved by Apple, Amazon, LG, Huawei, Samsung app stores, and is whitelisted by top Antivirus companies.
the idea that games should be written solely to extract revenue from players is so repulsive to me that I actively disrespect and disfavor people I know who work on things like this. humans are a truly horrible species and this kind of thing is a great example of why I believe that.
First off, make a website defend mode that can be triggered to serve different content. Then, do the following: 1. Add a robots.txt, make it look like it's wordpress (Disallow: /wp-admin etc) 2. If any client requests /wp-admin, flag their IP ASN as bot. 3. If a client is a bot, send it a gzip bomb (100kB size, unpacked around 20GB), use Transfer-Encoding: gzip and Content-Encoding: gzip to also punish malicious web…
Not possible (unless you're talking double gzip). gzip's max compression ratio is 1032:1[1]. So 100kB can expand to at most ~103MB with single gzip.
Brotli allows much larger compression. Here's[2] a brotli bomb I created that's 81MB compressed and 100TB uncompressed. That's a 1.2M:1 compression ratio.
[1] https://stackoverflow.com/a/16794960
[2] https://github.com/google/google-ctf/blob/main/2019/finals/m...