#zipbomb — Public Fediverse posts

#zipbomb
Bon, juste pour le fun, j'ai modifié ma zipbomb de 200 Go : Ce n'est plus un fichier rempli de zéro, c'est un document html avec des entêtes valides qui ouvre des <div> sans jamais les fermer. Je suppose que les parseurs DOM ne vont pas trop aimer. Faudra voir si je trouve d'autres moyen de pourrir un parseur html.
(Le fichier compressé fait 314 Mo au lieu 228 Mo mais c'est pas trop grave)

#zipbomb
Bon, juste pour le fun, j'ai modifié ma zipbomb de 200 Go : Ce n'est plus un fichier rempli de zéro, c'est un document html avec des entêtes valides qui ouvre des <div> sans jamais les fermer. Je suppose que les parseurs DOM ne vont pas trop aimer. Faudra voir si je trouve d'autres moyen de pourrir un parseur html.
(Le fichier compressé fait 314 Mo au lieu 228 Mo mais c'est pas trop grave)

#zipbomb
Bon, juste pour le fun, j'ai modifié ma zipbomb de 200 Go : Ce n'est plus un fichier rempli de zéro, c'est un document html avec des entêtes valides qui ouvre des <div> sans jamais les fermer. Je suppose que les parseurs DOM ne vont pas trop aimer. Faudra voir si je trouve d'autres moyen de pourrir un parseur html.
(Le fichier compressé fait 314 Mo au lieu 228 Mo mais c'est pas trop grave)

#zipbomb
Bon, juste pour le fun, j'ai modifié ma zipbomb de 200 Go : Ce n'est plus un fichier rempli de zéro, c'est un document html avec des entêtes valides qui ouvre des <div> sans jamais les fermer. Je suppose que les parseurs DOM ne vont pas trop aimer. Faudra voir si je trouve d'autres moyen de pourrir un parseur html.
(Le fichier compressé fait 314 Mo au lieu 228 Mo mais c'est pas trop grave)

#zipbomb
Bon, juste pour le fun, j'ai modifié ma zipbomb de 200 Go : Ce n'est plus un fichier rempli de zéro, c'est un document html avec des entêtes valides qui ouvre des <div> sans jamais les fermer. Je suppose que les parseurs DOM ne vont pas trop aimer. Faudra voir si je trouve d'autres moyen de pourrir un parseur html.
(Le fichier compressé fait 314 Mo au lieu 228 Mo mais c'est pas trop grave)

#fun #ZipBomb
🤔 mmmm...
quelqu'un m'a envoyé un article intéressant, ça me donne des idées... je vais essayer de remplacer ma bête zip-bomb (constituée de 200 Go de zéro) par du html valide.
Genre... ouvrir plein de <div> qui ne se ferment jamais, histoire de bien plomber les parseurs html (J'imagine qu'ils utilisent majoritairement des parseurs de type DOM plutôt que des parseurs genre SAX).
Ça risque d'être rigolo. 😈

#fun #ZipBomb
🤔 mmmm...
quelqu'un m'a envoyé un article intéressant, ça me donne des idées... je vais essayer de remplacer ma bête zip-bomb (constituée de 200 Go de zéro) par du html valide.
Genre... ouvrir plein de <div> qui ne se ferment jamais, histoire de bien plomber les parseurs html (J'imagine qu'ils utilisent majoritairement des parseurs de type DOM plutôt que des parseurs genre SAX).
Ça risque d'être rigolo. 😈

#fun #ZipBomb
🤔 mmmm...
quelqu'un m'a envoyé un article intéressant, ça me donne des idées... je vais essayer de remplacer ma bête zip-bomb (constituée de 200 Go de zéro) par du html valide.
Genre... ouvrir plein de <div> qui ne se ferment jamais, histoire de bien plomber les parseurs html (J'imagine qu'ils utilisent majoritairement des parseurs de type DOM plutôt que des parseurs genre SAX).
Ça risque d'être rigolo. 😈

#fun #ZipBomb
🤔 mmmm...
quelqu'un m'a envoyé un article intéressant, ça me donne des idées... je vais essayer de remplacer ma bête zip-bomb (constituée de 200 Go de zéro) par du html valide.
Genre... ouvrir plein de <div> qui ne se ferment jamais, histoire de bien plomber les parseurs html (J'imagine qu'ils utilisent majoritairement des parseurs de type DOM plutôt que des parseurs genre SAX).
Ça risque d'être rigolo. 😈

#fun #ZipBomb
🤔 mmmm...
quelqu'un m'a envoyé un article intéressant, ça me donne des idées... je vais essayer de remplacer ma bête zip-bomb (constituée de 200 Go de zéro) par du html valide.
Genre... ouvrir plein de <div> qui ne se ferment jamais, histoire de bien plomber les parseurs html (J'imagine qu'ils utilisent majoritairement des parseurs de type DOM plutôt que des parseurs genre SAX).
Ça risque d'être rigolo. 😈

A IT-Sec Christmas / New Year again? 🤔

Is this: "Large ZIP files trigger spurious possible zip bomb errors" → https://gitlab.archlinux.org/archlinux/packaging/packages/unzip/-/issues/3

…this again → https://www.bamsoftware.com/hacks/zipbomb/

…or not or what? 😬

#zip #itsec #zipcar #itsecurity #compras #opensource #basic #ITbasics #grml #rudimental #issues #itissues #xkcd #zipbomb

A IT-Sec Christmas / New Year again? 🤔

Is this: "Large ZIP files trigger spurious possible zip bomb errors" → https://gitlab.archlinux.org/archlinux/packaging/packages/unzip/-/issues/3

…this again → https://www.bamsoftware.com/hacks/zipbomb/

…or not or what? 😬

#zip #itsec #zipcar #itsecurity #compras #opensource #basic #ITbasics #grml #rudimental #issues #itissues #xkcd #zipbomb

A IT-Sec Christmas / New Year again? 🤔

Is this: "Large ZIP files trigger spurious possible zip bomb errors" → https://gitlab.archlinux.org/archlinux/packaging/packages/unzip/-/issues/3

…this again → https://www.bamsoftware.com/hacks/zipbomb/

…or not or what? 😬

#zip #itsec #zipcar #itsecurity #compras #opensource #basic #ITbasics #grml #rudimental #issues #itissues #xkcd #zipbomb

A IT-Sec Christmas / New Year again? 🤔

Is this: "Large ZIP files trigger spurious possible zip bomb errors" → https://gitlab.archlinux.org/archlinux/packaging/packages/unzip/-/issues/3

…this again → https://www.bamsoftware.com/hacks/zipbomb/

…or not or what? 😬

#zip #itsec #zipcar #itsecurity #compras #opensource #basic #ITbasics #grml #rudimental #issues #itissues #xkcd #zipbomb

A IT-Sec Christmas / New Year again? 🤔

Is this: "Large ZIP files trigger spurious possible zip bomb errors" → https://gitlab.archlinux.org/archlinux/packaging/packages/unzip/-/issues/3

…this again → https://www.bamsoftware.com/hacks/zipbomb/

…or not or what? 😬

#zip #itsec #zipcar #itsecurity #compras #opensource #basic #ITbasics #grml #rudimental #issues #itissues #xkcd #zipbomb

A Better Zip Bomb

https://www.bamsoftware.com/hacks/zipbomb/

#HackerNews #A #Better #Zip #Bomb #zipbomb #cybersecurity #hacking #software #compression

A Better Zip Bomb

https://www.bamsoftware.com/hacks/zipbomb/

#HackerNews #A #Better #Zip #Bomb #zipbomb #cybersecurity #hacking #software #compression

A Better Zip Bomb

https://www.bamsoftware.com/hacks/zipbomb/

#HackerNews #A #Better #Zip #Bomb #zipbomb #cybersecurity #hacking #software #compression

A Better Zip Bomb

https://www.bamsoftware.com/hacks/zipbomb/

#HackerNews #A #Better #Zip #Bomb #zipbomb #cybersecurity #hacking #software #compression

A Better Zip Bomb

https://www.bamsoftware.com/hacks/zipbomb/

#HackerNews #A #Better #Zip #Bomb #zipbomb #cybersecurity #hacking #software #compression

Ok I can confirm that gzip bombs work great!
I almost crashed my PC Firefox testing my own bomb.

I got inspiration from @lord 's article: https://lord.re/en/posts/139-gzip-bomb-nginx/ for the bomb
and from @robin 's article https://icewind.nl/entry/nixos-add-nginx-options/
To automate adding the bomb by default to every virtual host I have (with NixOS).
You can find the result here: https://framagit.org/ppom/nixos/-/commit/9a53e5de1df2ed6a3548d5ae94a8ac1178787248

#nixos #nginx #botfighting #sysadmin #zipbomb

Ok I can confirm that gzip bombs work great!
I almost crashed my PC Firefox testing my own bomb.

I got inspiration from @lord 's article: https://lord.re/en/posts/139-gzip-bomb-nginx/ for the bomb
and from @robin 's article https://icewind.nl/entry/nixos-add-nginx-options/
To automate adding the bomb by default to every virtual host I have (with NixOS).
You can find the result here: https://framagit.org/ppom/nixos/-/commit/9a53e5de1df2ed6a3548d5ae94a8ac1178787248

#nixos #nginx #botfighting #sysadmin #zipbomb

Ok I can confirm that gzip bombs work great!
I almost crashed my PC Firefox testing my own bomb.

I got inspiration from @lord 's article: https://lord.re/en/posts/139-gzip-bomb-nginx/ for the bomb
and from @robin 's article https://icewind.nl/entry/nixos-add-nginx-options/
To automate adding the bomb by default to every virtual host I have (with NixOS).
You can find the result here: https://framagit.org/ppom/nixos/-/commit/9a53e5de1df2ed6a3548d5ae94a8ac1178787248

#nixos #nginx #botfighting #sysadmin #zipbomb

Ok I can confirm that gzip bombs work great!
I almost crashed my PC Firefox testing my own bomb.

I got inspiration from @lord 's article: https://lord.re/en/posts/139-gzip-bomb-nginx/ for the bomb
and from @robin 's article https://icewind.nl/entry/nixos-add-nginx-options/
To automate adding the bomb by default to every virtual host I have (with NixOS).
You can find the result here: https://framagit.org/ppom/nixos/-/commit/9a53e5de1df2ed6a3548d5ae94a8ac1178787248

#nixos #nginx #botfighting #sysadmin #zipbomb

A valid HTML zip bomb, https://ache.one/notes/html_zip_bomb by @ache

The article shows how to create an HTML zip bomb for AI crawlers not respecting the `robots.txt` file.

A zip bomb is a huge file (like 10Gib), that once compressed, has a reasonable size like 10Mib. An AI crawler will uncompressed it and will see all its memory being consumed, leading to a possible crash.

That’s an effective way to counter-attack disrespectful AI crawlers.

#html #ZipBomb #ai

A valid HTML zip bomb, https://ache.one/notes/html_zip_bomb by @ache

The article shows how to create an HTML zip bomb for AI crawlers not respecting the `robots.txt` file.

A zip bomb is a huge file (like 10Gib), that once compressed, has a reasonable size like 10Mib. An AI crawler will uncompressed it and will see all its memory being consumed, leading to a possible crash.

That’s an effective way to counter-attack disrespectful AI crawlers.

#html #ZipBomb #ai

A valid HTML zip bomb, https://ache.one/notes/html_zip_bomb by @ache

The article shows how to create an HTML zip bomb for AI crawlers not respecting the `robots.txt` file.

A zip bomb is a huge file (like 10Gib), that once compressed, has a reasonable size like 10Mib. An AI crawler will uncompressed it and will see all its memory being consumed, leading to a possible crash.

That’s an effective way to counter-attack disrespectful AI crawlers.

#html #ZipBomb #ai

A valid HTML zip bomb, https://ache.one/notes/html_zip_bomb by @ache

The article shows how to create an HTML zip bomb for AI crawlers not respecting the `robots.txt` file.

A zip bomb is a huge file (like 10Gib), that once compressed, has a reasonable size like 10Mib. An AI crawler will uncompressed it and will see all its memory being consumed, leading to a possible crash.

That’s an effective way to counter-attack disrespectful AI crawlers.

#html #ZipBomb #ai

A valid HTML zip bomb, https://ache.one/notes/html_zip_bomb by @ache

The article shows how to create an HTML zip bomb for AI crawlers not respecting the `robots.txt` file.

A zip bomb is a huge file (like 10Gib), that once compressed, has a reasonable size like 10Mib. An AI crawler will uncompressed it and will see all its memory being consumed, leading to a possible crash.

That’s an effective way to counter-attack disrespectful AI crawlers.

#html #ZipBomb #ai

A valid #HTML #zip bomb

The initial problem is the aggressiveness of #LLM web #crawlers that don't respect "robots.txt". The first idea that comes to mind is IP #blocking . However, web crawlers have circumvented this restriction by using individual IPs via specialized #botnets .

Another solution is therefore to exhaust the resources of the harvesters. With a #zipbomb , we attempt to #exhaust their #RAM .

💭 https://ache.one/notes/html_zip_bomb

A valid #HTML #zip bomb

The initial problem is the aggressiveness of #LLM web #crawlers that don't respect "robots.txt". The first idea that comes to mind is IP #blocking . However, web crawlers have circumvented this restriction by using individual IPs via specialized #botnets .

Another solution is therefore to exhaust the resources of the harvesters. With a #zipbomb , we attempt to #exhaust their #RAM .

💭 https://ache.one/notes/html_zip_bomb

A valid #HTML #zip bomb

The initial problem is the aggressiveness of #LLM web #crawlers that don't respect "robots.txt". The first idea that comes to mind is IP #blocking . However, web crawlers have circumvented this restriction by using individual IPs via specialized #botnets .

Another solution is therefore to exhaust the resources of the harvesters. With a #zipbomb , we attempt to #exhaust their #RAM .

💭 https://ache.one/notes/html_zip_bomb

Sentient Beings Welcome!

Others please read this carefully.
Any attempt by bots, automated accounts and AI to follow or otherwise scrape this account despite #nobot #noai hashtag will be answered by me accordingly and then do not say you have not been warned ..
I work for sentient beings and not for machines of capitalists. Stay away!

#fediverse #mastodon #noai #nobot #zipbomb

Sentient Beings Welcome!

Others please read this carefully.
Any attempt by bots, automated accounts and AI to follow or otherwise scrape this account despite #nobot #noai hashtag will be answered by me accordingly and then do not say you have not been warned ..
I work for sentient beings and not for machines of capitalists. Stay away!

#fediverse #mastodon #noai #nobot #zipbomb

Sentient Beings Welcome!

Others please read this carefully.
Any attempt by bots, automated accounts and AI to follow or otherwise scrape this account despite #nobot #noai hashtag will be answered by me accordingly and then do not say you have not been warned ..
I work for sentient beings and not for machines of capitalists. Stay away!

#fediverse #mastodon #noai #nobot #zipbomb

Sentient Beings Welcome!

Others please read this carefully.
Any attempt by bots, automated accounts and AI to follow or otherwise scrape this account despite #nobot #noai hashtag will be answered by me accordingly and then do not say you have not been warned ..
I work for sentient beings and not for machines of capitalists. Stay away!

#fediverse #mastodon #noai #nobot #zipbomb

Sentient Beings Welcome!

Others please read this carefully.
Any attempt by bots, automated accounts and AI to follow or otherwise scrape this account despite #nobot #noai hashtag will be answered by me accordingly and then do not say you have not been warned ..
I work for sentient beings and not for machines of capitalists. Stay away!

#fediverse #mastodon #noai #nobot #zipbomb

I use Zip Bombs to Protect my Server

https://idiallo.com/blog/zipbomb-protection

The majority of the traffic on the web is from bots. For the most part, these bots are used to discover new content. These are RSS Feed readers, search engines crawling your content, or nowadays AI bots

#scrapers #zipbomb

I use Zip Bombs to Protect my Server

https://idiallo.com/blog/zipbomb-protection

The majority of the traffic on the web is from bots. For the most part, these bots are used to discover new content. These are RSS Feed readers, search engines crawling your content, or nowadays AI bots

#scrapers #zipbomb

Another tool for our arsenal of protections against adversarial bots:

https://idiallo.com/blog/zipbomb-protection

#zipbomb #zipbombs #bots #crawlers #aislop #infosec

Another tool for our arsenal of protections against adversarial bots:

https://idiallo.com/blog/zipbomb-protection

#zipbomb #zipbombs #bots #crawlers #aislop #infosec

Another tool for our arsenal of protections against adversarial bots:

https://idiallo.com/blog/zipbomb-protection

#zipbomb #zipbombs #bots #crawlers #aislop #infosec

Another tool for our arsenal of protections against adversarial bots:

https://idiallo.com/blog/zipbomb-protection

#zipbomb #zipbombs #bots #crawlers #aislop #infosec

Another tool for our arsenal of protections against adversarial bots:

https://idiallo.com/blog/zipbomb-protection

#zipbomb #zipbombs #bots #crawlers #aislop #infosec

I use zip bombs to protect my server

https://idiallo.com/blog/zipbomb-protection

#HackerNews #zipbomb #serverprotection #cybersecurity #datasecurity #techblog

I use zip bombs to protect my server

https://idiallo.com/blog/zipbomb-protection

#HackerNews #zipbomb #serverprotection #cybersecurity #datasecurity #techblog

I use zip bombs to protect my server

https://idiallo.com/blog/zipbomb-protection

#HackerNews #zipbomb #serverprotection #cybersecurity #datasecurity #techblog

I use zip bombs to protect my server

https://idiallo.com/blog/zipbomb-protection

#HackerNews #zipbomb #serverprotection #cybersecurity #datasecurity #techblog

I use zip bombs to protect my server

https://idiallo.com/blog/zipbomb-protection

#HackerNews #zipbomb #serverprotection #cybersecurity #datasecurity #techblog

Hey does anyone know if there's still a working zip bomb style exploit that can be deployed on a static site/JS (or as a asset/resource)? Specifically to target web scrapers and AI bullshit? The second any server goes online now it's immediately bombarded by stupid numbers of requests.

#hacking #aislop #crawlers #webscraping #webcrawler #robots #zipbomb #zipbombing #exploit #robotstxt #server #scraper

Hey does anyone know if there's still a working zip bomb style exploit that can be deployed on a static site/JS (or as a asset/resource)? Specifically to target web scrapers and AI bullshit? The second any server goes online now it's immediately bombarded by stupid numbers of requests.

#hacking #aislop #crawlers #webscraping #webcrawler #robots #zipbomb #zipbombing #exploit #robotstxt #server #scraper

Hey does anyone know if there's still a working zip bomb style exploit that can be deployed on a static site/JS (or as a asset/resource)? Specifically to target web scrapers and AI bullshit? The second any server goes online now it's immediately bombarded by stupid numbers of requests.

#hacking #aislop #crawlers #webscraping #webcrawler #robots #zipbomb #zipbombing #exploit #robotstxt #server #scraper

Hey does anyone know if there's still a working zip bomb style exploit that can be deployed on a static site/JS (or as a asset/resource)? Specifically to target web scrapers and AI bullshit? The second any server goes online now it's immediately bombarded by stupid numbers of requests.

#hacking #aislop #crawlers #webscraping #webcrawler #robots #zipbomb #zipbombing #exploit #robotstxt #server #scraper

#Sécurité #ZipBomb : Ça y est, quelqu'un a réussi à compresser NodeJS :troll:

« Une fois décompressé, ce fichier Zip de 46 Mo atteint… 4500 To » sur https://www.01net.com/actualites/une-fois-decompresse-ce-fichier-zip-de-46-mo-atteint-45-po-1729093.html

#Sécurité #ZipBomb : Ça y est, quelqu'un a réussi à compresser NodeJS :troll:

« Une fois décompressé, ce fichier Zip de 46 Mo atteint… 4500 To » sur https://www.01net.com/actualites/une-fois-decompresse-ce-fichier-zip-de-46-mo-atteint-45-po-1729093.html