News for hackers. Stuff that matters.

A comment on Defending a website with Zip bombs. Parent comment

Re:Defending a website with Zip bombs by cyounkins on Thursday July 06, 2017 @12:31AM (#14708142)
It's unlikely any of the parsers would apply recursive decompression, so a ZipQuine isn't going to help exhaust resources.
[ Parent | on HN ]
Re:Defending a website with Zip bombs by vog on Thursday July 06, 2017 @02:29AM (#14708532)
Indeed. ZipQuines are not targeted against servers, but against middleware. More precisely, these try to attack certain kinds of "security scanners". Those security scanners want to unpack as much as possible, by design(!), otherwise bad code could hide behind yet another round of compressed container formats.
[ Parent | on HN ]
Re:Defending a website with Zip bombs by masklinn on Thursday July 06, 2017 @05:07AM (#14709025)
Yes scanners and AV is what's targetted by quines.
[ Parent | on HN ]
Re:Defending a website with Zip bombs by pinpeliponni on Thursday July 06, 2017 @01:36AM (#14708358)
At least none of the Java libraries seemed to fall for this when I tried.
[ Parent | on HN ]
Re:Defending a website with Zip bombs by amenghra on Thursday July 06, 2017 @12:41AM (#14708174)
True. I wonder what's the largest file you can decompress to given some bound on the compressed result.
[ Parent | on HN ]