Re:Defending a website with Zip bombs
by amenghra on Thursday July 06, 2017 @12:17AM
(#14708095)
If you are smart, you craft your compressed files to be infinite by making them Quines: https://alf.nu/ZipQuine
[ Parent
| on HN ]
It's unlikely any of the parsers would apply recursive decompression, so a ZipQuine isn't going to help exhaust resources.
Indeed. ZipQuines are not targeted against servers, but against middleware. More precisely, these try to attack certain kinds of "security scanners". Those security scanners want to unpack as much as possible, by design(!), otherwise bad code could hide behind yet another round of compressed container formats.
Yes scanners and AV is what's targetted by quines.
Re:Defending a website with Zip bombs
by pinpeliponni on Thursday July 06, 2017 @01:36AM
(#14708358)
At least none of the Java libraries seemed to fall for this when I tried.