311–320 of 467 posts
Back when I was a stupid kid, I once did ln -s /dev/zero index.html on my home page as a joke. Browsers at the time didn’t like that, they basically froze, sometimes taking the client system down with them. Later on, browsers started to check for actual content I think, and would abort such requests.
> At my old employer, a bot discovered a wordpress vulnerability and inserted a malicious script into our server I know it's slightly off topic, but it's just so amusing (edit: reassuring) to know I'm not the only one who, after 1 hour of setting up Wordpress there's a PHP shell magically deployed on my server.
I never hosted WP, but as soon as you have a HTTP server expose to the internet you will get request to /wp-login and such. It as become a good way to find bots also. If I see an IP requesting anything from a popular CMS, hop it goes in the iptables holes
Is there any legal exposure possible? Like, a legitimate crawler suing you and alleging that you broke something of theirs?
Disclosure: IANAL The CFAA[1] prohibits: > knowingly causes the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer; As far as I can tell (again, IANAL) there isn't an exception if you believe said computer is actively attempting to abuse your system[2]. I'm not sure if a zip bomb would constitute intenti…
(I'm half-joking, half-crying. It's how everything else works, basically. Why would it not work here? You could even go as far as explicitly calling it a "zipbomb test delivery service". It's not your fault those bots have no understanding what they're connecting to…)
These days, almost all browsers accept zstd and brotli, so these bombs can be even more effective today! [This]( https://news.ycombinator.com/item?id=23496794 ) old comment showed an impressive 1.2M:1 compression ratio and [zstd seems to be doing even better]( https://github.com/netty/netty/issues/14004 ). Though, bots may not support modern compression standards. Then again, that may be a good way to block bots: eve…
[1] checkboxes demo https://checkboxes.andersmurphy.com
[2] article on brotli SSE https://andersmurphy.com/2025/04/15/why-you-should-use-brotl...
Earlier quoted context omitted.
It requires at leadt few bytes, there is no way to represent 10GB of data in 8 bits.
But of course there is. Imagine the following compression scheme: 0-253: output the input byte 254 followed by 0: output 254 254 followed by 1: output 255 255: output 10GB of zeroes Of course this is an artificial example, but theoretically it's perfectly sound. In fact, I think you could get there with static huffman trees supported by some formats, including gzip.
Earlier quoted context omitted.
Yes, servers can respond without specifying the size by using chunked encoding. And you can do the rest with a custom web server that just handles request by returning " " in a loop. I have no idea if browsers are vulnerable to such a thing.
I would make it an invisible link from the main page (hidden behind a logo or something). Users won't click it, but bots will.
Back when I was a stupid kid, I once did ln -s /dev/zero index.html on my home page as a joke. Browsers at the time didn’t like that, they basically froze, sometimes taking the client system down with them. Later on, browsers started to check for actual content I think, and would abort such requests.
Wait, you set up a symlink? I am not sure how that could’ve worked. Unless the real /dev tree was exposed to your webserver’s chroot environment, this would’ve given nothing special except “file not found”. The whole point of chroot for a webserver was to shield clients from accessing special files like that!
Earlier quoted context omitted.
Yes, servers can respond without specifying the size by using chunked encoding. And you can do the rest with a custom web server that just handles request by returning " " in a loop. I have no idea if browsers are vulnerable to such a thing.
I just tested it via a small python script sending divs at a rate of ~900mb (as measured by curl) and firefox just kills the request after 1-2 gb received (~2 seconds) with an "out of memory" error, while chrome seems to only receive around 1mb/s, uses 1 cpu core 100%, and grows infinitely in memory use. I killed it after 3 mins and consuming ca. 6GB (additionally, on top of the memory it used at startup)
Earlier quoted context omitted.
> you can always create zip bombs that are links on a web page that don't show up for humans I did a version of this with my form for requesting an account on my fediverse server. The problem I was having is that there exist these very unsophisticated bots that crawl the web and submit their very unsophisticated spam into every form they see that looks like it might publish it somewhere. First I added a simple captch…
I did essentially the same thing. I have this input in a form: Email: With this CSS: .nah { opacity: 0; position: absolute; top: 0; left: 0; height: 0; width: 0; z-index: -1; } And any form submission with a value set for the email is blocked. It stopped 100% of the spam I was getting.