Test files › Security and validation
Sample Security and validation test files
Free security and validation test files for QA and developers: eicar.com.txt, gtube-spam.txt, html-xss-payloads.html, path-traversal-payloads.txt, polyglot-gif-html.gif, shell-script.sh and more. Each with a published SHA-256 and a note on what it catches.
| File | Format | Size | What it catches |
eicar.com.txt | TXT | 68 bytes | The EICAR Standard Anti-Virus Test File: a 68-byte printable-ASCII string that every mainstream scanner is required to detect as if it were malware. It is not malware and contains no malicious code - it is a harmless COM program that prints a message. |
gtube-spam.txt | TXT | 90 bytes | The GTUBE (Generic Test for Unsolicited Bulk Email) string, which SpamAssassin and compatible filters score as definitively spam. |
html-xss-payloads.html | HTML | 855 bytes | A catalogue of common XSS vectors - inline script, event handlers, javascript: URLs, SVG and iframe payloads. Every payload calls console.log only. |
path-traversal-payloads.txt | TXT | 305 bytes | A newline-delimited list of path-traversal encodings: plain, URL-encoded, double-encoded, UTF-8 overlong, backslash and mixed variants. Intended as fuzzer input, not as a file to extract. |
polyglot-gif-html.gif | GIF + HTML polyglot | 192 bytes | A file that is simultaneously a valid GIF (correct GIF89a header and dimensions) and valid HTML containing an inert script. Renders as an image to an image parser and as a page to a browser. |
shell-script.sh | Shell script | 65 bytes | An executable shell script that only prints a line. Present to test extension blocklists. |
sql-injection-payloads.txt | TXT | 157 bytes | Newline-delimited SQL injection strings for input-validation fuzzing. Includes tautologies, comment terminators, union probes and stacked-query syntax. |
windows-batch.bat | Batch file | 69 bytes | A Windows batch file that only echoes a line. |