Serve up zip/XML bombs?

[VorpalBlade]

Saw the fosdem recording. Quite funny!

But it got me thinking: why not serve up data that uncompresses to be massive. For example:

• By sending specially crafted data with zlib compression at the Http protocol level.
• By serving zip files that contain themselves, or contain infinite directories, etc.
• XML bombs and yaml bombs are also a thing.

I feel like there is some potential here.

[ryanolee]

Ha, sound like a good idea 😆 I think it is probably worth putting behind a config var that defaults to disabled if so. As it somewhat changes the dynamic of the pot and connecting client from one that serves misleading but otherwise asinine content predicated on interactions with the honeypot to actively serving intentionally malicious content. Which though a slight distinction would likely stop the honeypot from being used in certain contexts / moves liability to whoever is hosting the pot. Might ask a few people I know on the cyber sec side of things what they think. As I would assume it would probably fall under a similar remit to websites hosting malware samples and the like in terms of the dynamic they have with connecting clients.

[VorpalBlade]

So a suggestion here would be to use robots.txt to mark such files off limits, and put a warning up for any humans who happen to stumble onto the page linking those files.

If any bots ignore that, it is their own fault.