Test files › Security and validation › polyglot-gif-html.gif
Sample GIF + HTML polyglot file
A file that is simultaneously a valid GIF (correct GIF89a header and dimensions) and valid HTML containing an inert script. Renders as an image to an image parser and as a page to a browser.
↓ Download polyglot-gif-html.gif| Filename | polyglot-gif-html.gif |
| Format | GIF + HTML polyglot |
| Size | 192 bytes (192 bytes) |
| MIME type | image/gif |
| SHA-256 | c965bb91779eaa8bbf8a03cca8ea28223de282237a38b736541b8f14eb724b5f |
What this file catchesContent-type sniffing. If your server serves user uploads without X-Content-Type-Options: nosniff, a browser may sniff this as HTML and execute it from your origin, even though it passed image validation on upload.
Download & verify
curl -fsSL -o "polyglot-gif-html.gif" "https://files.hexaqa.com/security/polyglot-gif-html.gif"
curl -fsSL "https://files.hexaqa.com/security/polyglot-gif-html.gif" | sha256sum
# expect: c965bb91779eaa8bbf8a03cca8ea28223de282237a38b736541b8f14eb724b5f