Hacker News Reader

Comment by Buge | Hacker News Reader

Do their requests indicate support for gzip for other compression protocols? One thing I've heard people do is send a response with a zip bomb that expands to essentially infinite size, causing their program to crash.

https://news.ycombinator.com/item?id=14707674

View on HN

Unless you have 100% precision in finding bad actors, this may end up zip-bombing some poor unlucky human.

Interesting read. But I'm wondering: how do you _create_ a zip bomb? Do you first need to create a petabyte file? Or can you compute it or something?

I believe you can do it off the command line relatively efficiently by piping output straight into gzip.

ie) perl -e "print '0' for (1..1000000000)" | gzip > zipbomb.gz

This will create a ~ 1MB file that will expand into something 1000 times its size.

Would probably be much more efficient to use /dev/zero:

  dd if=/dev/zero of=/dev/stdout bs=1M count=1024 | gzip > zipbomb.gz

However, you're restricted to NUL bytes there. However, you can vastly improve your original Perl script by writing more chars at a time:

  perl -e "my \$x = ('0' x 1000000); print \$x for (1..1000)" | gzip > zipbomb.gz

That runs about as fast as the dd variant on my system, and about 10 times faster than your original formulation.

yes 0 | head -n 1000000000 | gzip > zipbomb.gz

There is an example available on the page linked to there.

Send them GZipped traffic anyways, since all legitimate clients support it.

Reply on news.ycombinator.com