Commit 5669a2c

@@ -0,0 +1,175 @@
+node_modules/
+
+# Logs
+
+logs
+_.log
+npm-debug.log_
+yarn-debug.log*
+yarn-error.log*
+lerna-debug.log*
+.pnpm-debug.log*
+
+# Caches
+
+.cache
+
+# Diagnostic reports (https://nodejs.org/api/report.html)
+
+report.[0-9]_.[0-9]_.[0-9]_.[0-9]_.json
+
+# Runtime data
+
+pids
+_.pid
+_.seed
+*.pid.lock
+
+# Directory for instrumented libs generated by jscoverage/JSCover
+
+lib-cov
+
+# Coverage directory used by tools like istanbul
+
+coverage
+*.lcov
+
+# nyc test coverage
+
+.nyc_output
+
+# Grunt intermediate storage (https://gruntjs.com/creating-plugins#storing-task-files)
+
+.grunt
+
+# Bower dependency directory (https://bower.io/)
+
+bower_components
+
+# node-waf configuration
+
+.lock-wscript
+
+# Compiled binary addons (https://nodejs.org/api/addons.html)
+
+build/Release
+
+# Dependency directories
+
+node_modules/
+jspm_packages/
+
+# Snowpack dependency directory (https://snowpack.dev/)
+
+web_modules/
+
+# TypeScript cache
+
+*.tsbuildinfo
+
+# Optional npm cache directory
+
+.npm
+
+# Optional eslint cache
+
+.eslintcache
+
+# Optional stylelint cache
+
+.stylelintcache
+
+# Microbundle cache
+
+.rpt2_cache/
+.rts2_cache_cjs/
+.rts2_cache_es/
+.rts2_cache_umd/
+
+# Optional REPL history
+
+.node_repl_history
+
+# Output of 'npm pack'
+
+*.tgz
+
+# Yarn Integrity file
+
+.yarn-integrity
+
+# dotenv environment variable files
+
+.env
+.env.development.local
+.env.test.local
+.env.production.local
+.env.local
+
+# parcel-bundler cache (https://parceljs.org/)
+
+.parcel-cache
+
+# Next.js build output
+
+.next
+out
+
+# Nuxt.js build / generate output
+
+.nuxt
+dist
+
+# Gatsby files
+
+# Comment in the public line in if your project uses Gatsby and not Next.js
+
+# https://nextjs.org/blog/next-9-1#public-directory-support
+
+# public
+
+# vuepress build output
+
+.vuepress/dist
+
+# vuepress v2.x temp and cache directory
+
+.temp
+
+# Docusaurus cache and generated files
+
+.docusaurus
+
+# Serverless directories
+
+.serverless/
+
+# FuseBox cache
+
+.fusebox/
+
+# DynamoDB Local files
+
+.dynamodb/
+
+# TernJS port file
+
+.tern-port
+
+# Stores VSCode versions used for testing VSCode extensions
+
+.vscode-test
+
+# yarn v2
+
+.yarn/cache
+.yarn/unplugged
+.yarn/build-state.yml
+.yarn/install-state.gz
+.pnp.*
+
+# IntelliJ based IDEs
+.idea
+
+# Finder (MacOS) folder config
+.DS_Store

@@ -0,0 +1,41 @@
+import http from 'http';
+import zlib from 'zlib';
+
+const options = {
+  hostname: 'localhost',
+  port: 3000,
+  path: '/trap',
+  method: 'GET',
+  headers: {
+    'Accept-Encoding': 'gzip, deflate'
+  }
+};
+
+const req = http.request(options, res => {
+  console.log(`STATUS: ${res.statusCode}`);
+  console.log(`HEADERS: ${JSON.stringify(res.headers)}`);
+
+  const gunzip = zlib.createGunzip();
+  let totalSize = 0;
+
+  res.pipe(gunzip);
+
+  gunzip.on('data', chunk => {
+    totalSize += chunk.length;
+    console.log(`Decompressed ${totalSize / (1024 * 1024)} MB...`);
+    if (totalSize > 1024 * 1024 * 500) { // Simulate crashing at 500MB
+      console.log("💥 Bot crashed! Out of memory.");
+      req.destroy();
+    }
+  });
+
+  gunzip.on('end', () => {
+    console.log('Decompression complete.');
+  });
+});
+
+req.on('error', e => {
+  console.error(`problem with request: ${e.message}`);
+});
+
+req.end();

@@ -0,0 +1,22 @@
+{
+  "name": "zipbomb",
+  "module": "server.ts",
+  "type": "module",
+  "version": "1.0.0",
+  "description": "A simple zip bomb server and client for testing purposes.",
+  "scripts": {
+    "server": "bun run server.ts",
+    "bot": "bun run bot.ts",
+  },
+
+  "devDependencies": {
+    "@types/bun": "latest",
+    "@types/express": "^5.0.1"
+  },
+  "peerDependencies": {
+    "typescript": "^5.0.0"
+  },
+  "dependencies": {
+    "express": "^5.1.0"
+  }
+}
\ No newline at end of file

@@ -0,0 +1,52 @@
+# 💣 Zip Bomb Trap Demo
+
+This project demonstrates a way to defend against malicious bots and crawlers by serving a compressed file (zip bomb) that decompresses into a massive payload, overwhelming memory-limited or poorly coded bots.
+
+Read this [blog post](https://example.com) for more details.
+
+---
+
+### ⚙️ What It Does
+
+- Runs a Express server (written in TypeScript).
+- Serves a regular homepage at `/`.
+- Serves a maliciously crafted gzip file at `/trap`.
+  - Appears small (e.g., 10MB).
+  - Decompresses into a massive file (e.g., 10GB).
+  - Can break naive crawlers, scrapers, or vulnerability scanners.
+
+Includes a **simulated bot client** that:
+- Sends `Accept-Encoding: gzip` header.
+- Downloads and attempts to decompress the trap.
+- Simulates a crash if memory exceeds a threshold (e.g., 500MB).
+
+---
+
+## 🧱 Project Structure
+
+```
+zip-bomb-demo/
+├── public/
+│ └── 10GB.gz # The zip bomb file
+├── server.ts # Express server
+├── bot.js # Crawler simulator (Node.js)
+├── package.json
+├── tsconfig.json
+└── README.md
+```
+
+---
+
+## 🛠 Setup Instructions
+
+```bash
+git clone <your-repo-url>
+cd zip-bomb-demo
+bun install # or npm install
+mkdir -p public
+dd if=/dev/zero bs=1G count=10 | gzip -c > public/10GB.gz  # ->> Create a 10GB gzip file
+bun run server.ts 
+bun run bot.ts
+```
+
+----
\ No newline at end of file

@@ -0,0 +1,24 @@
+import express from 'express';
+import path from 'path';
+import fs from 'fs';
+
+const app = express();
+const PORT = 3000;
+const zipBombPath = path.join(__dirname,'10GB.gz');
+
+app.get('/', (req, res) => {
+  res.send('Welcome to the Zip Bomb Demo Server. Try hitting /trap as a bot would.');
+});
+
+app.get('/trap', (req, res) => {
+  console.log(`Bot caught! IP: ${req.ip}`);
+  res.setHeader('Content-Encoding', 'gzip');
+  res.setHeader('Content-Type', 'text/html');
+  res.setHeader('Content-Length', fs.statSync(zipBombPath).size.toString());
+  const stream = fs.createReadStream(zipBombPath);
+  stream.pipe(res);
+});
+
+app.listen(PORT, () => {
+  console.log(`Zip Bomb server running at http://localhost:${PORT}`);
+});

@@ -0,0 +1,27 @@
+{
+  "compilerOptions": {
+    // Enable latest features
+    "lib": ["ESNext", "DOM"],
+    "target": "ESNext",
+    "module": "ESNext",
+    "moduleDetection": "force",
+    "jsx": "react-jsx",
+    "allowJs": true,
+
+    // Bundler mode
+    "moduleResolution": "bundler",
+    "allowImportingTsExtensions": true,
+    "verbatimModuleSyntax": true,
+    "noEmit": true,
+
+    // Best practices
+    "strict": true,
+    "skipLibCheck": true,
+    "noFallthroughCasesInSwitch": true,
+
+    // Some stricter flags (disabled by default)
+    "noUnusedLocals": false,
+    "noUnusedParameters": false,
+    "noPropertyAccessFromIndexSignature": false
+  }
+}