Hacker News Reader

Comment by timwis | Hacker News Reader

Interesting read. But I'm wondering: how do you _create_ a zip bomb? Do you first need to create a petabyte file? Or can you compute it or something?

I believe you can do it off the command line relatively efficiently by piping output straight into gzip.

ie) perl -e "print '0' for (1..1000000000)" | gzip > zipbomb.gz

This will create a ~ 1MB file that will expand into something 1000 times its size.

Would probably be much more efficient to use /dev/zero:

  dd if=/dev/zero of=/dev/stdout bs=1M count=1024 | gzip > zipbomb.gz

However, you're restricted to NUL bytes there. However, you can vastly improve your original Perl script by writing more chars at a time:

  perl -e "my \$x = ('0' x 1000000); print \$x for (1..1000)" | gzip > zipbomb.gz

That runs about as fast as the dd variant on my system, and about 10 times faster than your original formulation.

yes 0 | head -n 1000000000 | gzip > zipbomb.gz

There is an example available on the page linked to there.