2025-02-08 15:25:05 +01:00
|
|
|
# PZB - php (g)zip bomb
|
|
|
|
|
|
|
|
|
|
## Description
|
|
|
|
|
|
|
|
|
|
10G gzip'd bomb into a single php file
|
|
|
|
|
|
2025-02-08 15:50:45 +01:00
|
|
|
There is also a brotli version (pbb.php) but not all bots may decode brotli
|
|
|
|
|
|
|
|
|
|
> [!WARNING]
|
|
|
|
|
> Brotli version decompress to a 10T file
|
|
|
|
|
|
2025-02-08 15:25:05 +01:00
|
|
|
## Usage
|
|
|
|
|
|
|
|
|
|
Drop the pzb.php file in any php ready host provider and an hidden link in your
|
|
|
|
|
website to the file:
|
|
|
|
|
|
|
|
|
|
```html
|
|
|
|
|
<a hidden href="pzb.php">pzb secret plan</a>
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
Don't forget to update your robots.txt to warn nice bots:
|
|
|
|
|
|
|
|
|
|
```robots.txt
|
|
|
|
|
disallow: /pzb.php
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
## Credits
|
|
|
|
|
|
|
|
|
|
Freely inspired by:
|
|
|
|
|
|
|
|
|
|
- <https://dustri.org/b/serving-a-gzip-bomb-with-caddy.html>
|
|
|
|
|
- <https://blog.haschek.at/2017/how-to-defend-your-website-with-zip-bombs.html>
|
|
|
|
|
- <https://github.com/cyberisltd/GzipBloat>
|
