4 ms·
Another fun one is sending a redirect to a gzip bomb or extremely large file (i.e. speedtest download file) for when certain non-existant URLs are requested, i.
by lgats 3y ago
Another fun one is sending a redirect to a gzip bomb or extremely large file (i.e. speedtest download file) for when certain non-existant URLs are requested, i.e. /wp-login.php on a non-wordpress site.
- KomoD 3y agoEarlier this month I was downloading top 1 million websites' robots.txt and some guy just served 100mb of whitespace :/
- pnpnp 3y agoI love it!
- hayley-patton 3y agoOnce I was trying to scrape from some internal API, and made a request that used parameters the real client wouldn't make. I didn't expect curl to scream "FUCK YOU <some name>" at me. Presumably the name belonged to someone who scraped it before.
- KomoD 3y agoLOL, that is great.
- gitgud 3y agoIs it legal to host a gzip bomb? Seems like a malicious file to serve up…
- bytesandbots 3y agoIt can cause your site to end up on Google's safe Browsing black list which can be a death sentence for a business. Google has automated process for identifying malware and black list such websites. Almost all browsers use this list to warn users. This is why it is also dangerous to host anonymous uploaded files even for a short time. https://news.ycombinator.com/item?id=25802366 https://news.ycombinator.com/item?id=25802366
- michaelcampbell 3y ago> It can cause your site to end up on Google's safe Browsing black list If it's a file that nothing on your site links to, and doesn't really "exist" how would google ever index it? Especially if you put in as a deny in robots.txt, which as far as I'm aware, Google honors.
- sieabahlpark 3y ago[dead]