How to defend your website with ZIP bombs (2017)
blog.haschek.at
How to defend your website with ZIP bombs (2017)
1–10 of 79 posts
Re: How to defend your website with ZIP bombs (2017)
#2Nice, I didn’t even know that ZIP bombs existed! I have seen some huge spam traffic on servers I run in the past so this will be a good tool for me to use. Thanks
Re: How to defend your website with ZIP bombs (2017)
#3TIL today: ZIP bombs are still a thing, 40 years after the first BBS.
Re: How to defend your website with ZIP bombs (2017)
#4I've done this without compression but just sending infinite data. On some days I've sent a TB to a single IP address... Might be an idea to combine this. I'd assume the resulting gzip file here contains a repeating pattern that you can generate on the fly?
Re: How to defend your website with ZIP bombs (2017)
#5Had it had a marked effect on the bots? Dropping *.php calls helped a lot.
Re: How to defend your website with ZIP bombs (2017)
#6Is it legal to purposefully distribute a malicious payload as a booby trap?
Re: How to defend your website with ZIP bombs (2017)
#7https://42.zip served just that (after the 42.zip named on https://en.wikipedia.org/wiki/Zip_bomb) until some ****hole reported it to Google/etc for.... phishing? Kinda sad, lol.
One of the arguments I've seen is: 'what if your antivirus scans it' to which I think: if your antivirus blows up on a zip bomb in 2024, you need a new antivirus that isn't total garbage?
Re: How to defend your website with ZIP bombs (2017)
#8If I recall correctly, HTTP clients do not need to care about Content-Encoding at all and can choose to just not do anything with your ZIP bomb. To really hit them, you will want to do this at the Transfer-Encoding level.
Re: How to defend your website with ZIP bombs (2017)
#9In the spirit of a good offence is the best defence, etc., I wonder if there are any other ways to defend my website.
Re: How to defend your website with ZIP bombs (2017)
#10I've done this without compression but just sending infinite data. On some days I've sent a TB to a single IP address... Might be an idea to combine this. I'd assume the resulting gzip file here contains a repeating pattern that you can generate on the fly?
A zip bomb is way more effective as it will be transferred very quickly and saturate attacker storage as fast as possible, with a good probability to make the system inoperable (login into a machine with with 0 storage left can be challenging).