Главная
Study mode:
on
1
Introduction
2
Topics
3
About Me
4
What is a decompression bomb
5
JPEG demo
6
Preview crashes
7
History
8
Misconceptions
9
Silicon Valley
10
Zip Bomb
11
Zip Cache
12
Compression Ratio
13
Security 101
14
Image bombs
15
JPEG2000
16
ZapFly
17
PNG
18
Image Dimensions
19
Separate Workers
20
HTTP Bombs
21
Firefox
22
broadly
23
crash
24
zip
25
compression chart
26
limiting resources
27
limiting request sizes
28
limiting compression ratio
29
testing
30
burp image extension
31
bombedcodes
32
discussion
Description:
Explore the devastating potential of decompression bomb attacks in this Black Hat conference talk. Learn about the history, misconceptions, and various types of compression algorithm exploits, including zip bombs, image bombs, and HTTP bombs. Discover how to audit compression algorithms for vulnerabilities, understand the highest compression ratios, and identify the sloppiest parsers. Gain insights into creating a library of open-source tools for security researchers and developers to test application vulnerabilities. Examine real-world examples, including JPEG demos and browser crashes, and learn essential security measures such as limiting resources, request sizes, and compression ratios. Equip yourself with knowledge to guard against this often-overlooked but potentially catastrophic denial of service attack.

Auditing the Compression Algorithm Weapon Cache

Black Hat
Add to list
0:00 / 0:00