🔍 Search

How to Make a Zip Bomb?

This ethical hacking trick explains what is a zip bomb, how it works, history of zip of death, 42.zip download and how to make a zip bomb on windows and linux.

What is a Zip Bomb?

Zip Bomb, also known as Decompression Bomb or Zip of Death, is a malicious compressed archive file specifically designed to deceive and overwhelm compression and decompression software.

When the victim attempts to decompress the Zip bomb, it unpacks a wide series of nested archives, each containing progressively larger files. As a result, the victim's system resources are quickly exhausted, causing the system to crash or slow down.

History of Zip Bombs

They have been in existence for many decades, and have evolved along with advances in technology and cybersecurity. The concept can be traced back to the early days of compression algorithms and archive file formats, such as ZIP, RAR, and 7z.

One of the earliest examples of a Zip bomb was the 42.zip file, created in the late 1990s. It was a relatively small archive file that, when decompressed, expanded into an enormous 4.5 petabytes of data. At the time, this was an impractical joke rather than a serious threat since storage and processing power were limited.

However, as technology advanced, so did the potential for decompression bombs to become more disruptive.

How Does a Zip Bomb Work?

To understand the methodology, it is necessary to understand the compression algorithms and the theory behind archive file formats. The most common archive format targeted by Zip bombs is the ZIP format, but similar principles can apply to other compression formats like RAR or 7z.

Compression algorithms aim to reduce file sizes by identifying recurring patterns and redundancies in data. These patterns are replaced with shorter references or codes. During decompression, the original data is reconstructed by reversing these transformations.

A Zip bomb exploits the recursive nature of compression algorithms. Here's a simplified step-by-step explanation of how it operates:

The attacker creates a ZIP archive containing several nested layers of compressed files.
Each nested layer is compressed to a slightly smaller size than the previous one, encouraging decompression software to continue expanding the archive.
When the victim opens or decompresses the Zip bomb, the decompression process begins. As the nested layers are sequentially unpacked, the archive's apparent size increases exponentially.
Eventually, the decompression process consumes an overwhelming amount of memory and system resources, causing system instability, crashes, or slowdowns.

Zip bombs are designed to be relatively small files at first glance, making them attractive for victims to open or decompress. However, their real danger lies in their ability to increase in size during the decompression process, so they are also known as decompression bombs.