News for hackers. Stuff that matters.

A comment on Defending a website with Zip bombs. Parent comment

Re:Defending a website with Zip bombs by rixrax on Thursday July 06, 2017 @10:55AM (#14710861)
I wonder how these techniques play along with random IDS/IPS/deep packet inspection/WAF/AV/DLP/web cache/proxy/load balancer/etc. devices that happen to look/peak into traffic that passes through network. I would wager my $ that more than a couple will need some admin(istrative) care after running some of this stuff via them.

And btw -- when you end up accidentally crashing/DoS:ing your corporate WAF or ISPs DPI, who are they going to call?

[ Parent | on HN ]
Re:Defending a website with Zip bombs by colanderman on Thursday July 06, 2017 @11:28AM (#14711118)
I worked on an IPS a few years back. It was specifically designed NOT to inflate arbitrary ZIP files. All decoders worked in a streaming fashion and were limited to a fixed (low) nesting depth and preallocated memory. Typically they would be configured to reject traffic such as the payload we've been discussing.
[ Parent | on HN ]