3 ms·
I found this: https://github.com/abdulfatir/ZipBomb https://github.com/abdulfatir/ZipBomb which I will be looking into today! Are zipbombs typically something a
by abuani 9y ago
I found this: https://github.com/abdulfatir/ZipBomb https://github.com/abdulfatir/ZipBomb which I will be looking into today! Are zipbombs typically something a developer should be actively writing to protect against? Or does a library like Helmet typically provide protection against these attack vectors?
- Cozumel 9y agoDon't rely on libraries, just sort yourself out with learning the basics :)
- abuani 9y agoNot trying to be lazy here, but what are some legitimate resources to begin learning? I'm willing to wade through the complexity, so white papers or research is also very welcome.
- fictioncircle 9y agoOwasp presentations, Blackhat presentations, etc. usually give you a general idea of what people are seeing and then you research the specific attack(s) in depth. This isn't the sort of thing you can commit to memory. https://www.owasp.org/images/c/c9/Benelux_day_20161125_G_Pellegrino_CompressionBombsStrikeBack.pdf https://www.owasp.org/images/c/c9/Benelux_day_20161125_G_Pel...
- WrtCdEvrydy 9y agoProtection generally comes in the fact that the AV will explode or your library will explode. You just need to ensure that such an explosion does not destroy your service as well.
- SomeStupidPoint 9y agoAnd try to make it explode quickly -- if it fails slowly, it can be uses to DDoS, by getting all your worker threads to spend most of their time on your files.