5 ms·

My "404-pests" fail2ban-client status, which drops everything making *.php requests (This machine has never had PHP installed...): 2a03:2880:10ff:14::face:b00c

• napolux 6y ago
  I think we're together in this, my friend
  • golem14 6y ago
    I believe, but have not tried, that you can craft zipped files that are small but when expanding produce multi-gigabyte files. If you can sufficiently target the bad guys, you can probably grind them to a halt by serving only them these files. Some care needs to be taken so you don’t harm the innocent and don’t run afoul of any laws that may apply. Good luck.
    • djxfade 6y ago
      Do you think it would be possible to create something similar for gzip? If you then serve with Content-Type: text/html, and Content-Encoding: gzip, the client would accept the payload. And when it tries to expand it, it would get expanded to a large file, eating up their resources.
      • notriddle 6y ago
        A single layer of deflate compression has a theoretical expansion limit of 1032:1. ZIP bombs with higher ratios only achieve it by nesting a ZIP file inside of another ZIP file and expecting the decompressor to be recursive. This means you can serve 1M payload and have it come out to 1G at decompression time. Not a bad compression ratio, but it doesn't seem like enough to break Facebook servers without taking on considerable load of your own. http://www.zlib.net/zlib_tech.html http://www.zlib.net/zlib_tech.html
      • golem14 6y ago
        That was the idea. There's a name for it - zip bomb. https://en.wikipedia.org/wiki/Zip_bomb https://en.wikipedia.org/wiki/Zip_bomb A superficial search leads to things like https://www.rapid7.com/db/modules/auxiliary/dos/http/gzip_bomb_dos https://www.rapid7.com/db/modules/auxiliary/dos/http/gzip_bo... https://stackoverflow.com/questions/1459673 https://stackoverflow.com/questions/1459673 You really want to be careful about potentially breaking laws ...
        • golem14 6y ago
          Here is another article: https://www.blackhat.com/docs/us-16/materials/us-16-Marie-I-Came-to-Drop-Bombs-Auditing-The-Compression-Algorithm-Weapons-Cache.pdf https://www.blackhat.com/docs/us-16/materials/us-16-Marie-I-... If FB supports brotli, a much bigger compression factor than 1000 is possible, apparently.
          • Thorrez 6y ago
            Here's a brotli file I created that's 81MB compressed and 100TB uncomrpessed[1] (bomb.br). That's a 1.2M:1 compression ratio (higher than any other brotli ratio I see mentioned online). There's also a script in that directory that allows you to create files of whatever size you want (hovering around that same compression ratio). You can even use it to embed secret messages in the brotli (compressed or uncompressed). There's also a python script there that will serve it with the right header. Note that for Firefox it needs to be hosted on https, because Firefox only supports brotli over https. Back when I created it, it would crash the entire browser of ESR Firefox, crash the tab of Chrome, and would lead to a perpetually loading page in regular Firefox. It's currently hosted at [CAREFUL] https://stuffed.web.ctfcompetition.com https://stuffed.web.ctfcompetition.com [CAREFUL] [1] https://github.com/google/google-ctf/tree/master/2019/finals/misc-stuffed-finals/app https://github.com/google/google-ctf/tree/master/2019/finals...