Code Monkey home page Code Monkey logo

flaskbomb's Introduction

b191ba7c6456d71b25cb65bbdfd20303.png

Abstract

  • Using the famous zip bomb concept (Silicon Valley S3E07), we can send a compressed web-page to the client.
  • The browser will unzip the small compressed page into a very big file, potentially crashing it.
  • This aims to disrupt or crash bots that scan websites to find vulnerabilities.

tldr - Python GZIP-Bomb HTTP Server

GZip HTTP Bombing in Python for everyone.

Uses Python Flask framework

Docker friendly

It even has it's own low effort logo.

Please keep in mind this is a counter-measure.

Based on this excellent piece by Christian Haschek

Flask Bomb

This repository contains the necessary files to:

  • Host a quick & dirty Flask web server that responds to web requests with a GZip archive as a response page.

  • The recommended way to use FlaskBomb is by deploying it with Docker. You can try it here:
    Try with Play-with-Docker


Features:

  • Quick and easy
  • Fast deployment using Docker
  • Lightweight Alpine based Docker container
  • Generic code
    • Implement your own rules or payloads !
  • (next)User-Agent evasion based on original work
  • Choose classic payload generation or faster append generation method

Usage:

docker run -it -p 80:5000 khanon/flaskbomb <normal|fast> <X> # X is the final payload's size in GB  
# Example:  
docker run -it -p 80:5000 khanon/flaskbomb fast 20

Default deployment sets options to normal 1

Demo - 20G Payloads

Standard docker build from git, demo with cURL

asciicast

Standard deploy from docker hub, demo with Nikto

asciicast

Details & Notes

  • Gzip's algorithm enables the possibility to append archives
    • normal method generates the payload in one single dd command
    • fast method generates a 1GB payload and appends itself n times. The final payload is bigger but generates much faster.
  • Python 3
  • Since this uses Flask's built-in web server, internal port is 5000
  • The payload is generated using gzip and dd on Docker entrypoint.
    • *NIX based for now
    • Full python payload is up for next release
  • Flask development server is used. It is recommended to deploy the application on a WGSI + HTTPD
  • For those not using docker, generate the payload using the bash commands in entrypoint.sh and save it as ./static/cake.gzip
    • The python GZip implementation should make this easier in the future

Roadmap

  • Evasion
  • Python gzip implementation
  • Load evasion URIs from DirBuster
  • Fingerprinting JS before payload delivery

flaskbomb's People

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.