http://lpoaj774fddyczsopqwpecbqanp243yjaz36bukhzqgafkmwlxrhhuqd.onion/posts/2024/07/zipbombing.html
Now, the method as described in the original post had several issues: bots/scanners not supporting compression would still get a gzipped file more efficient methods than gzip (such as brotli or zstd) weren't considered ‒ tbf we dunno'f brotli or zstd give away their uncompressed size in metadata, we do know that gzip only gives ya the modulo 1024 size or so, so it's impossible'a tell whether ur getting 10KB or 10GB basically, still, we figured for bots/scanners not protected against this sorta attack, they...