Sample ZIP file — free download
ZIP archives for extraction, upload and security testing — clean archives plus the classic attacks: path traversal (Zip Slip), absolute paths, deep nesting and a safe, small zip bomb.
Need a specific size?
Streamed on demand — nothing stored, no signup, any size up to 2 GB.
10 ready-made ZIP test files
| File | Size | What it catches | |
|---|---|---|---|
| empty.zip | 22 bytes | Import flows that assume at least one entry and throw on an empty iterator, or report success having processed nothing. | download |
| absolute-path.zip | 161 bytes | The less-tested cousin of Zip Slip. Extractors must strip leading slashes and drive letters rather than honouring an absolute destination. | download |
| corrupt-central-directory.zip | 219 bytes | Readers that trust the central directory blindly and crash, versus tolerant ones that can recover entries by scanning local headers. | download |
| zip-slip-traversal.zip | 357 bytes | Extractors that join the entry name to the destination without normalising and re-checking containment (Zip Slip, CVE-2018-1002200 and dozens of siblings). A correct extractor rejects this entry; a vulnerable one writes outside the target directory. | download |
| valid-flat.zip | 376 bytes | Baseline extraction check. | download |
| valid-nested-dirs.zip | 390 bytes | Extractors that fail to create intermediate directories, and Windows targets where the expanded path exceeds MAX_PATH (260 chars). | download |
| unicode-entry-names.zip | 563 bytes | Extractors that ignore the UTF-8 flag and fall back to CP437, producing mojibake filenames - still common on Windows. | download |
| nested-10-deep.zip | 1.2 KB | Recursive scanners (antivirus, content indexers, import jobs) with no depth limit. A bounded extractor should stop at a configured depth and report it, not recurse forever. | download |
| modest-zip-bomb.zip | 996 KB | Extraction with no output-size cap or compression-ratio check. Your extractor should abort once the decompressed total crosses a threshold, rather than filling the disk. Expansion ratio ~1000:1. | download |
| mixed-content-50mb.zip | 40.0 MB | Progress reporting that extrapolates from compressed bytes, and memory use in extractors that buffer whole entries instead of streaming. | download |
Every file is generated from source — no third-party copyright — and each has its own page with a published SHA-256 you can verify after download.
Questions
What is Zip Slip?
A path-traversal attack where an archive entry is named ../../etc/passwd, so a naive extractor writes outside the target directory. The Zip Slip file below contains such an entry so you can prove your extractor rejects it.
Is the zip bomb safe to download?
Yes. It is a deliberately modest one — it expands enough to prove your limits work without being able to fill a disk.
Why do DOCX and XLSX look like ZIP files?
Because they are. Every OOXML and OpenDocument file is a ZIP of XML parts, so they all begin with the same PK signature. See the file signatures reference for how to tell them apart.