brotli bomb PoC

A brotli "decompression bomb": a ~1 MB file on disk that expands to 50 GB in the browser. The decompressed payload starts with a real PNG, so the image renders — then the browser keeps inflating the trailing 50 GB of zeros and runs out of memory / crashes the tab.

Files

File	What it does
image.png	The real image embedded at the front of the payload (input).
create.py	Builds the bomb: [PNG] + 1 MB random + 50 GB zeros → bomb.png.br.
bomb.png.br	The compressed bomb (~1 MB on disk, 50 GB decompressed).
server.py	Minimal Flask server that serves the bomb with Content-Encoding: br.
slow_download.py	Fuller server: inline <img> page + download route.

Usage

python create.py        # build bomb.png.br (pass --rebuild to overwrite)
python server.py        # serve on :8080, then open in a browser

⚠️ Opening the page makes the browser decompress 50 GB into memory. Expect the tab to hang and crash.