Penbomb is a Go HTTP handler that returns a zip bomb.
It is designed to punish pentesters scraping sites at endpoints that would normally just return a 404 in a Go app, e.g. /.env or /wp-admin.
Depending on the incoming Accept-Encoding header, it will prefer to send a brotli payload. If brotli is not accepted, it will send a gzip payload.
Brotli payload sourced from: zipbomb.me © 2019-2025 by Austin Hartzheim, licensed under CC BY-NC-SA 4.0