5 ms·

Might be fun to respond with one of these to malicious requests for /.env, /.git/config and /.aws/credentials instead of politely returning 404s.

bspammer 1y ago
It’s definitely tempting, but I prefer not to piss off people who are already being actively malicious.
- philodeon 1y ago
  Isn’t this how a court system works?
- Twirrim 1y ago
  It's all just spray-and-pray crap. You're extremely unlikely to be their target, they're just looking for a convenient shell for a botnet. The most likely way they'll handle it if you do actually break them is just blacklist your address. You're not going to be worth the effort.
Twirrim 1y ago
I've been sending a nice 10GB gzip bomb (12MB after compression, rate limited download speed) to people that send various malicious requests. I think I might update it tonight with this other approach.
- 1718627440 1y ago
  Can't you just server /dev/urandom?
  - Faaak 1y ago
    And eat up your bandwidth?
  - masklinn 1y ago
    The goal is to DOS the abuser, so the cost to the server needs to be much lower than to the client. /dev/urandom is not at all that.
  - Twirrim 1y ago
    I could, at the expense of a lot of bandwidth. /dev/urandom doesn't compress, so to send something that would consume 10GB of memory, I'd have to use up 10GB of bandwidth. The 10GB of /dev/zero that I return in response to requests takes up just 11MB of bandwidth. Much more efficient use of my bandwidth. A more effective (while still relatively efficient) alternative would be to have a program that returns an infinite gzip compressed page. That'll catch anyone that doesn't set a timeout on their requests. I don't imagine it would be too difficult to write a python app that dynamically creates the content, just have the returned content be the output of a generator. Not sure it's worth it though :)
    - Twirrim 1y ago
      I had a few minutes. This turns out to be really easy to do with FastAPI: from fastapi import FastAPI from starlette.responses import StreamingResponse from fastapi.middleware.gzip import GZipMiddleware app = FastAPI() app.add_middleware(GZipMiddleware, minimum_size=0, compresslevel=9) def lol_generator(): while True: yield "LOL\n" @app.get("/") def stream_text(): return StreamingResponse(lol_generator(), media_type="text/plain") Away it goes, streaming GZIP compressed "LOL" to the receiver, and will continue for as long as they want it to. I guess either someone's hard disk is getting full, they OOM, or they are sensible and have timeouts set on their clients. Probably needs some work to ensure only clients that accept GZIP get it.
      - Twirrim 1y ago
        Yikes, the gzip stdlib module is painfully slow in python. Even by "I'm used to python being slow" standards, and even under pypy. Even if I drop it down to compresslevel=5, what I'm most likely to do is consume all my CPU, than the target's memory. A quick port to rust with gemini's help has it running significantly faster for a lot less overhead.
jamesfinlayson 1y ago
I thought someone posted a blog post from someone who does in the last couple of months? Any time they got hits on their site from misbehaving bots I think they returned a gzip bomb in the HTTP response.
- zikduruqe 1y ago
  I remember that also. edit - this? https://idiallo.com/blog/zipbomb-protection https://idiallo.com/blog/zipbomb-protection
  - jamesfinlayson 1y ago
    Yes that's the one.

bspammer 1y ago

It’s definitely tempting, but I prefer not to piss off people who are already being actively malicious.

philodeon 1y ago
Isn’t this how a court system works?
Twirrim 1y ago
It's all just spray-and-pray crap. You're extremely unlikely to be their target, they're just looking for a convenient shell for a botnet. The most likely way they'll handle it if you do actually break them is just blacklist your address. You're not going to be worth the effort.

Twirrim 1y ago

I've been sending a nice 10GB gzip bomb (12MB after compression, rate limited download speed) to people that send various malicious requests. I think I might update it tonight with this other approach.

1718627440 1y ago
Can't you just server /dev/urandom?
- Faaak 1y ago
  And eat up your bandwidth?
- masklinn 1y ago
  The goal is to DOS the abuser, so the cost to the server needs to be much lower than to the client. /dev/urandom is not at all that.
- Twirrim 1y ago
  I could, at the expense of a lot of bandwidth. /dev/urandom doesn't compress, so to send something that would consume 10GB of memory, I'd have to use up 10GB of bandwidth. The 10GB of /dev/zero that I return in response to requests takes up just 11MB of bandwidth. Much more efficient use of my bandwidth. A more effective (while still relatively efficient) alternative would be to have a program that returns an infinite gzip compressed page. That'll catch anyone that doesn't set a timeout on their requests. I don't imagine it would be too difficult to write a python app that dynamically creates the content, just have the returned content be the output of a generator. Not sure it's worth it though :)
  - Twirrim 1y ago
    I had a few minutes. This turns out to be really easy to do with FastAPI: from fastapi import FastAPI from starlette.responses import StreamingResponse from fastapi.middleware.gzip import GZipMiddleware app = FastAPI() app.add_middleware(GZipMiddleware, minimum_size=0, compresslevel=9) def lol_generator(): while True: yield "LOL\n" @app.get("/") def stream_text(): return StreamingResponse(lol_generator(), media_type="text/plain") Away it goes, streaming GZIP compressed "LOL" to the receiver, and will continue for as long as they want it to. I guess either someone's hard disk is getting full, they OOM, or they are sensible and have timeouts set on their clients. Probably needs some work to ensure only clients that accept GZIP get it.
    - Twirrim 1y ago
      Yikes, the gzip stdlib module is painfully slow in python. Even by "I'm used to python being slow" standards, and even under pypy. Even if I drop it down to compresslevel=5, what I'm most likely to do is consume all my CPU, than the target's memory. A quick port to rust with gemini's help has it running significantly faster for a lot less overhead.

jamesfinlayson 1y ago

I thought someone posted a blog post from someone who does in the last couple of months? Any time they got hits on their site from misbehaving bots I think they returned a gzip bomb in the HTTP response.

zikduruqe 1y ago
I remember that also. edit - this? https://idiallo.com/blog/zipbomb-protection https://idiallo.com/blog/zipbomb-protection
- jamesfinlayson 1y ago
  Yes that's the one.