Return to Question

A Zip bomb (concept here) seems quite a "smart" and easy vulnerability to websites where uploading ZIP files is allowed. Such sites are under a threat (at least to make some degree of damage to them) - someone uploads i.e. a 100 KB file [ 50 GB compressed] to your site and when your site extracts (or whoever opens that) runs out of resources, causing the consequent damages.

Antivirus software is said to detect such zip bombs by detecting the recursion depth and common patterns, but i dont ask about Windows OS or like that (where we could be protected by AV) but i speak on websites (i.e. vps or shared hosting) where we just use programming languages (i.e. PHP).

1. Are there any kind of builtin solutions in PHP, which already prevents happening that? if not how can we limit that? (any code example)

2. How can we detect these kinds of files on our servers (without extracting them)?

3. Another layer of attack seems to send a request with a Gzip bomb. How can we protect against that?

A Zip bomb (concept here) seems quite a "smart" and easy vulnerability to websites where uploading ZIP files is allowed. Such sites are under a threat (at least to make some degree of damage to them) - someone uploads i.e. a 100 KB file [ 50 GB compressed] to your site and when your site extracts (or whoever opens that) runs out of resources, causing the consequent damages.

Antivirus software is said to detect such zip bombs by detecting the recursion depth and common patterns, but i dont ask about Windows OS or like that (where we could be protected by AV) but i speak on websites (i.e. vps or shared hosting) where we just use programming languages (I'm interested in PHP, but for other people might Java or ASP also needed).

1. Are there any kind of builtin solutions in PHP(etc..), which already prevents happening that? if not how can we limit that? (any code example)

2. How can we detect these kinds of files on our servers (without extracting them)?

3. Another layer of attack seems to send a request with a Gzip bomb. How can we protect against that?

A Zip bomb (concept here) seems quite a "smart" and easy vulnerability to websites where uploading ZIP files is allowed. Such sites are under a threat (at least to make some degree of damage to them) - someone uploads i.e. a 100 KB file to your site and your site (or whoever opens that) runs out of resources, causing the consequent possible vulnerabilities and damages.

Antivirus software is said to detect such zip bombs by detecting the recursion depth and common patterns, but:

• i dont ask about Windows OS or like that (where we could be protected by AV) but i speak on websites (i.e. vps or shared hosting) where we just use programming languages to do operations. So, I'm looking for solutions (or details, how they are work-arounded) in PHP, Java, or ASP:

1. How can we detect these kinds of files on our servers (without extracting them)?

2. Another layer of attack seems to send a request with a Gzip bomb. How can we protect against that?

3. Also, how can we protect against reference bombs?

A Zip bomb (concept here) seems quite a "smart" and easy vulnerability to websites where uploading ZIP files is allowed. Such sites are under a threat (at least to make some degree of damage to them) - someone uploads i.e. a 100 KB file [ 50 GB compressed] to your site and when your site extracts (or whoever opens that) runs out of resources, causing the consequent damages.

Antivirus software is said to detect such zip bombs by detecting the recursion depth and common patterns, but i dont ask about Windows OS or like that (where we could be protected by AV) but i speak on websites (i.e. vps or shared hosting) where we just use programming languages (i.e. PHP).

1. Are there any kind of builtin solutions in PHP, which already prevents happening that? if not how can we limit that? (any code example)

2. How can we detect these kinds of files on our servers (without extracting them)?

3. Another layer of attack seems to send a request with a Gzip bomb. How can we protect against that?

A Zip bomb (concept here) seems quite a "smart" and easy vulnerability to websites where uploading ZIP files is allowed. Such sites are under a threat (at least to make some degree of damage to them) - someone uploads i.e. a 100 KB file to your site and your site (or whoever opens that) runs out of resources, causing the consequent possible vulnerabilities and damages.

Antivirus software is said to detect such zip bombs by detecting the recursion depth and common patterns, but I think that someone might just create one text file of 1000 GB, and compress it directly into a 100 KB ZIP file.

1. How can we detect these kinds of files on our servers (without extracting them)?

2. Another layer of attack seems to send a request with a Gzip bomb. How can we protect against that?

3. Also, how can we protect against reference bombs?

I'm looking for solutions in PHP, Java, and ASP.

A Zip bomb (concept here) seems quite a "smart" and easy vulnerability to websites where uploading ZIP files is allowed. Such sites are under a threat (at least to make some degree of damage to them) - someone uploads i.e. a 100 KB file to your site and your site (or whoever opens that) runs out of resources, causing the consequent possible vulnerabilities and damages.

Antivirus software is said to detect such zip bombs by detecting the recursion depth and common patterns, but:

• i dont ask about Windows OS or like that (where we could be protected by AV) but i speak on websites (i.e. vps or shared hosting) where we just use programming languages to do operations. So, I'm looking for solutions (or details, how they are work-arounded) in PHP, Java, or ASP:

1. How can we detect these kinds of files on our servers (without extracting them)?

2. Another layer of attack seems to send a request with a Gzip bomb. How can we protect against that?

3. Also, how can we protect against reference bombs?