Post #2972679
2024-12-28 04:05 UTC
@kkarhan@infosec.space may i also add i personally redirect these bots to gz.niko.lgbt which returns a innocent looking 100MB HTTP response with content-encoding: gzip that decompresses to 100GB
and the only way to find out is to actually decompress it so if they want anything they gotta go through it
Replies (3)
-
@khobochka@mastodon.social 2024-12-28 11:05
@niko@furry.engineer @kkarhan@infosec.space aw, beautiful, [g]ZIP bombs are the best! 💣
-
@drwho@hackers.town 2024-12-28 19:25
@niko@furry.engineer @kkarhan@infosec.space What do you use? .htaccess? Curious because I'm thinking of automating the deployment of such a configuration to all of my stuff.
-
@ghard@mastodon.social 2024-12-29 09:51
@niko@furry.engineer @kkarhan@infosec.space that single url is easy to blacklist but zipbombs are easy enough to add to nginx front-end on URL paths that won’t be found by hoomans, but are easy for crawlers to spot.