zipbomb/index.html at main · anonymous-201/zipbomb · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>ZipBomb Generator | anonymous-201</title>

    <!-- Primary Meta Tags -->
    <meta name="title" content="ZipBomb Generator">
    <meta name="description" content="A browser-based ZIP bomb generator. Enter your desired unzip size and ZIP file name to generate a decompression bomb. For educational and security research purposes only.">
    <meta name="keywords" content="zipbomb, zip bomb, decompression bomb, zip of death, security research, compression, DEFLATE, antivirus testing, open source">
    <meta name="author" content="anonymous-201">
    <meta name="license" content="MIT">
    <meta name="theme-color" content="#38bdf8">

    <!-- Open Graph / Facebook -->
    <meta property="og:type" content="website">
    <meta property="og:url" content="https://anonymous-201.github.io/zipbomb/">
    <meta property="og:title" content="ZipBomb Generator">
    <meta property="og:description" content="Browser-based ZIP bomb generator — specify your unzip size and filename. For educational and security research purposes only.">
    <meta property="og:image" content="https://anonymous-201.github.io/zipbomb/preview.png">

    <!-- Twitter -->
    <meta name="twitter:card" content="summary_large_image">
    <meta name="twitter:url" content="https://anonymous-201.github.io/zipbomb/">
    <meta name="twitter:title" content="ZipBomb Generator">
    <meta name="twitter:description" content="Browser-based ZIP bomb generator — specify your unzip size and filename. For educational and security research purposes only.">
    <meta name="twitter:image" content="https://anonymous-201.github.io/zipbomb/preview.png">

    <!-- GitHub / Open Source -->
    <link rel="canonical" href="https://anonymous-201.github.io/zipbomb/">

    <script src="https://cdnjs.cloudflare.com/ajax/libs/jszip/3.10.1/jszip.min.js"></script>
    <style>
        :root {
            --bg-color: #0f172a;
            --card-bg: #1e293b;
            --accent-color: #38bdf8;
            --text-color: #f8fafc;
            --text-muted: #94a3b8;
        }

        body {
            font-family: 'Segoe UI', Tahoma, Geneva, Verdana, sans-serif;
            background-color: var(--bg-color);
            color: var(--text-color);
            margin: 0;
            padding: 20px;
            display: flex;
            justify-content: center;
            align-items: center;
            min-height: 100vh;
        }

        .container {
            background-color: var(--card-bg);
            padding: 30px;
            border-radius: 12px;
            box-shadow: 0 10px 25px rgba(0, 0, 0, 0.3);
            width: 100%;
            max-width: 450px;
        }

        h2 {
            margin-top: 0;
            color: var(--accent-color);
            font-size: 1.5rem;
            text-align: center;
            border-bottom: 1px solid #334155;
            padding-bottom: 15px;
        }

        .form-group {
            margin-bottom: 20px;
        }

        label {
            display: block;
            margin-bottom: 8px;
            font-weight: 600;
            font-size: 0.9rem;
        }

        input[type="text"], input[type="number"], select {
            width: 100%;
            padding: 10px;
            border: 1px solid #475569;
            background-color: #0f172a;
            color: #fff;
            border-radius: 6px;
            box-sizing: border-box;
            font-size: 1rem;
        }

        input:focus, select:focus {
            outline: none;
            border-color: var(--accent-color);
        }

        .input-group {
            display: flex;
            gap: 10px;
        }

        .input-group input {
            flex: 2;
        }

        .input-group select {
            flex: 1.5;
        }

        button {
            width: 100%;
            padding: 12px;
            background-color: var(--accent-color);
            color: #0f172a;
            border: none;
            border-radius: 6px;
            font-size: 1rem;
            font-weight: bold;
            cursor: pointer;
            transition: background 0.2s;
        }

        button:hover {
            background-color: #7dd3fc;
        }

        button:disabled {
            background-color: #475569;
            color: #94a3b8;
            cursor: not-allowed;
        }

        #status {
            margin-top: 20px;
            padding: 12px;
            border-radius: 6px;
            background-color: #0f172a;
            font-size: 0.85rem;
            display: none;
            border-left: 4px solid var(--accent-color);
            word-wrap: break-word;
        }

        .info-text {
            font-size: 0.8rem;
            color: var(--text-muted);
            margin-top: 15px;
            text-align: center;
            line-height: 1.4;
        }
    </style>
</head>
<body>

<div class="container">
    <h2>💣 ZipBomb Generator</h2>

    <div class="form-group">
        <label for="fileName">ZIP File Name</label>
        <input type="text" id="fileName" value="mock_storage" placeholder="e.g., test_file">
    </div>

    <div class="form-group">
        <label for="fileSize">Desired Unzipped Size</label>
        <div class="input-group">
            <input type="number" id="fileSize" value="1" min="1">
            <select id="sizeUnit">
                <option value="B">Bytes (B)</option>
                <option value="KB">Kilobytes (KB)</option>
                <option value="MB">Megabytes (MB)</option>
                <option value="GB">Gigabytes (GB)</option>
                <option value="TB">Terabytes (TB)</option>
                <option value="PB" selected>Petabytes (PB)</option>
            </select>
        </div>
    </div>

    <button id="generateBtn" onclick="generateArchive()">Generate & Download</button>

    <div id="status"></div>

    <div class="info-text">
        Generates a ZIP bomb using DEFLATE compression. Supports sizes from Bytes up to Petabytes.<br><br>
        ⚠️ <strong>For educational & security research purposes only.</strong><br>
        Do not use against systems you don't own or have permission to test.<br><br>
        <a href="https://github.com/anonymous-201/zipbomb" target="_blank" rel="noopener noreferrer"
           style="color: #38bdf8; text-decoration: none; font-weight: 600;">
            ⭐ View on GitHub — anonymous-201/zipbomb
        </a>
    </div>
</div>

<script>
    const MULTIPLIERS = { B: 1, KB: 1024, MB: 1024**2, GB: 1024**3, TB: 1024**4, PB: 1024**5 };

    // Max bytes we'll actually allocate in RAM at once (64 MB chunk)
    const CHUNK_SIZE = 64 * 1024 * 1024;

    // Browser RAM cap: allocating more than ~1.5 GB of null bytes at once crashes most tabs.
    // For sizes beyond this we build a Blob by concatenating chunk Blobs — the browser
    // manages Blob storage off the JS heap, so RAM stays flat regardless of requested size.
    const RAM_SAFE_LIMIT = 1.5 * 1024 * 1024 * 1024; // 1.5 GB

    function makeRepeatingBlob(totalBytes) {
        // Build a zero-byte Blob of `totalBytes` by concatenating independent Blob chunks.
        //
        // IMPORTANT: do NOT use Uint8Array.subarray() views here. They are views into a
        // shared buffer that can be GC'd before JSZip reads the Blob asynchronously,
        // causing "file could not be read / permission" errors.
        //
        // Instead, each chunk is wrapped in its own new Blob() immediately, which copies
        // the data into browser-managed storage that is pinned and GC-safe.
        // We reuse one source Uint8Array just for the Blob constructor call.
        const srcBuf = new Uint8Array(CHUNK_SIZE); // zeroed source; reused each iteration
        const parts  = [];
        let remaining = totalBytes; // BigInt
        while (remaining > 0n) {
            const size = remaining > BigInt(CHUNK_SIZE) ? CHUNK_SIZE : Number(remaining);
            parts.push(new Blob([srcBuf.subarray(0, size)]));  // Blob copies → GC-safe
            remaining -= BigInt(size);
        }
        return new Blob(parts); // browser lazily concatenates inner Blobs
    }

    async function generateArchive() {
        const fileNameInput = document.getElementById('fileName').value.trim() || 'zipbomb';
        const sizeInput     = parseFloat(document.getElementById('fileSize').value);
        const unit          = document.getElementById('sizeUnit').value;
        const button        = document.getElementById('generateBtn');
        const statusDiv     = document.getElementById('status');

        if (isNaN(sizeInput) || sizeInput <= 0) {
            alert("Please enter a valid positive number.");
            return;
        }

        // Use BigInt for TB/PB to avoid floating-point overflow
        const multiplier  = MULTIPLIERS[unit];
        const totalBytes  = BigInt(Math.round(sizeInput * multiplier));

        button.disabled       = true;
        button.innerText      = "Processing…";
        statusDiv.style.display = "block";
        statusDiv.innerHTML   = `⚙️ Preparing <strong>${sizeInput} ${unit}</strong> payload…`;

        const zip = new JSZip();

        try {
            if (Number(totalBytes) <= RAM_SAFE_LIMIT) {
                // ── Small/medium path: allocate exact buffer in RAM ──────────────
                statusDiv.innerHTML = `⚙️ Allocating ${sizeInput} ${unit} in memory…`;
                // Yield to UI so the status text actually renders before we block
                await new Promise(r => setTimeout(r, 30));

                const payload = new Uint8Array(Number(totalBytes));
                zip.file(`${fileNameInput}.txt`, payload, { compression: "DEFLATE", compressionOptions: { level: 9 } });

            } else {
                // ── Large path: build a Blob off-heap, chunk by chunk ────────────
                // JSZip's browser build supports Blob as file content natively.
                // ReadableStream is NOT supported in the browser JSZip bundle.
                statusDiv.innerHTML = `⚙️ Building ${sizeInput} ${unit} Blob via chunked writer…`;
                await new Promise(r => setTimeout(r, 30));

                const blob = makeRepeatingBlob(totalBytes);
                zip.file(`${fileNameInput}.txt`, blob, { compression: "DEFLATE", compressionOptions: { level: 9 } });
            }

            statusDiv.innerHTML = "🗜️ Running DEFLATE compression (level 9)…";
            await new Promise(r => setTimeout(r, 30));

            const blob = await zip.generateAsync(
                { type: "blob", compression: "DEFLATE", compressionOptions: { level: 9 } },
                ({ percent }) => {
                    statusDiv.innerHTML = `🗜️ Compressing… ${percent.toFixed(1)}%`;
                }
            );

            statusDiv.innerHTML = "📦 Preparing download…";

            const url = URL.createObjectURL(blob);
            const a   = document.createElement('a');
            a.href     = url;
            a.download = `${fileNameInput}.zip`;
            document.body.appendChild(a);
            a.click();
            document.body.removeChild(a);
            URL.revokeObjectURL(url);

            const zipMB = (blob.size / 1024 / 1024).toFixed(2);
            statusDiv.innerHTML =
                `✅ <strong>Done!</strong> Downloaded <code>${fileNameInput}.zip</code><br>` +
                `📂 Unzipped size: <strong>${sizeInput} ${unit}</strong><br>` +
                `💾 ZIP file size: <strong>${zipMB} MB</strong>`;

        } catch (err) {
            statusDiv.innerHTML =
                `<span style="color:#ef4444;">❌ Error: ${err.message}<br>` +
                `Try a smaller size — your browser may have hit its memory limit.</span>`;
            console.error(err);
        } finally {
            button.disabled  = false;
            button.innerText = "Generate & Download";
        }
    }
</script>

</body>
</html>