← Back to context

Comment by kevin_thibedeau

7 months ago

If you nest the gzip inside another gzip it gets even smaller since the blocks of compressed '0' data are themselves low entropy in the first generation gzip. Nested zst reduces the 10G file to 99 bytes.

But the bot likely only automatically unpacks the outer layer. So nesting doesn't help with bot deterrence.

Wouldnt that defeat the attack though as you arent serving the large content anymore

  • It would need a bot that is accessing files via hyperlink with an aim to decompress them and riffle through their contents. The compressed file can be delivered over a compressed response to achieve the two layers, cutting down significantly on the outbound traffic. passwd.zst, secrets.docx, etc. would look pretty juicy. Throw some bait in honeypot directories (exposed for file access) listed in robots.txt and see who takes it.