Oohh, that's a nice exercise. A few more ideas that should be easy to implement: - Content-Type: application/json, and body {"response"꞉ "success"} (hint: that

Oohh, that's a nice exercise. A few more ideas that should be easy to implement: - Content-Type: application/json, and body {"response"꞉ "success"} (hint: that's not an ASCII colon). - Content-Type: application/json, and body [[[[[...]]]]] nested ten thousand times. - Redirect to their own public IP, and at a random common port. - Redirect to their own public IP in dotless hexadecimal notation (ping 172.217.23.110 -> ping 0xacd9176e). - From[1], redirect to http://example.com/;'$(gt=$(perl$IFS-E$IFS's//62/;s/62/chr/e;say');eval$IFS''cowsay$IFS''pwned$IFS$gt/dev/tty)';cowsay$IFS''pwned (or instead of "cowsay" run "cat" to block their script) - Pick a header, then insert one from [EICAR test string[2], \x00, \n] somewhere in the middle. - Or just add a "Server:" header with a random line from the Big List of Naughty Strings[3]. - Redirect to a normal URL, but with a trailing dot in the domain name[4], like "example.com.". It's valid, but you'd be surprised how many things it breaks. - Nested content encoding with "Content-Encoding: gzip, gzip, gzip, gzip, ...", with a random depth. The n-1 payload is "WAZAAAA". - "Content-Type: image/jpeg" and "Content‑Encoding: gzip" with a valid gzip body... But the ‑ in "Content‑Encoding" is U+2011 NON-BREAKING HYPHEN. - "Content-Type: image/jpeg" and "Content-Language: en-US\u000bContent‑Encoding: gzip" with a valid gzip body, where \u000b is a vertical tab. - Spin the wheel of HTTP status codes! res.WriteHeader(rand.Intn(1000)) - Infinite loop sending a 100 (Continue) every five seconds (they might have a timeout for the TCP and TLS handshakes, and even a timeout for the next TCP segment... But did they remember to set a timeout for receiving the HTTP body?). Watch out for running out of connections. [1] https://github.com/jwilk/url.sh https://github.com/jwilk/url.sh [2] https://en.wikipedia.org/wiki/EICAR_test_file https://en.wikipedia.org/wiki/EICAR_test_file [3] https://github.com/minimaxir/big-list-of-naughty-strings https://github.com/minimaxir/big-list-of-naughty-strings [4] https://en.wikipedia.org/wiki/Fully_qualified_domain_name https://en.wikipedia.org/wiki/Fully_qualified_domain_name