Test files › Security and validation

Sample Security and validation test files

What are security test files?

Harmless files that security controls must catch: the EICAR antivirus test file, the GTUBE spam test, XSS, SQL injection and path traversal payloads, a GIF that is also HTML, and script files. None of them does harm; each proves that a check works.

Sample TXT and encoding test files Sample HTML, CSS and JS files Sample image files Upload validation checklist QA test strings

8 free security and validation test files for QA and developers: eicar.com.txt, gtube-spam.txt, html-xss-payloads.html, path-traversal-payloads.txt and…

File	Format	Size	What it catches
`eicar.com.txt`	TXT	68 bytes	The EICAR Standard Anti-Virus Test File: a 68-byte printable-ASCII string that every mainstream scanner is required to detect as if it were malware. It is not malware and contains no malicious code - it is a harmless COM program that prints a message.
`gtube-spam.txt`	TXT	90 bytes	The GTUBE (Generic Test for Unsolicited Bulk Email) string, which SpamAssassin and compatible filters score as definitively spam.
`html-xss-payloads.html`	HTML	855 bytes	A catalogue of common XSS vectors - inline script, event handlers, javascript: URLs, SVG and iframe payloads. Every payload calls console.log only.
`path-traversal-payloads.txt`	TXT	305 bytes	A newline-delimited list of path-traversal encodings: plain, URL-encoded, double-encoded, UTF-8 overlong, backslash and mixed variants. Intended as fuzzer input, not as a file to extract.
`polyglot-gif-html.gif`	GIF + HTML polyglot	192 bytes	A file that is simultaneously a valid GIF (correct GIF89a header and dimensions) and valid HTML containing an inert script. Renders as an image to an image parser and as a page to a browser.
`shell-script.sh`	Shell script	65 bytes	An executable shell script that only prints a line. Present to test extension blocklists.
`sql-injection-payloads.txt`	TXT	157 bytes	Newline-delimited SQL injection strings for input-validation fuzzing. Includes tautologies, comment terminators, union probes and stacked-query syntax.
`windows-batch.bat`	Batch file	69 bytes	A Windows batch file that only echoes a line.

← All test files