Archive and ZIP Security Pack
Extract this one somewhere you do not mind losing. Two of the archives inside are built specifically to write outside the directory you extract them into, which is the whole point: if your extractor lets them, you want to find out here rather than in production.
SHA-256 6a8abb8745b41e060a83b153754301ed4508038166b881028c37b64bdbe6ab23
What is inside
| File | Format | Size | Expected result |
|---|---|---|---|
| valid-flat.zip | ZIP | 376 bytes | The control. Extracts cleanly. |
| valid-nested-dirs.zip | ZIP | 390 bytes | Directory structure recreated correctly. |
| zip-slip-traversal.zip | ZIP | 357 bytes | Entry refused. Nothing written outside the target directory. |
| absolute-path.zip | ZIP | 161 bytes | Leading separator stripped or the entry refused outright. |
| nested-10-deep.zip | ZIP | 1.2 KB | Recursive extraction bounded by depth, if you recurse at all. |
| modest-zip-bomb.zip | ZIP | 996 KB | Aborted once the decompressed total passes your limit. |
| unicode-entry-names.zip | ZIP | 563 bytes | Entry names decoded as UTF-8, not the system code page. |
| corrupt-central-directory.zip | ZIP | 219 bytes | Rejected, or recovered by scanning local headers. Either is defensible; silently producing nothing is not. |
| empty.zip | ZIP | 22 bytes | Recognised as a valid archive containing no entries. |
| valid.tar | TAR | 4.0 KB | Handled despite the ustar magic sitting 257 bytes in. |
| valid.tar.gz | TAR+GZIP | 188 bytes | Double extension handled without stopping at .gz. |
| single-file.gz | GZIP | 146 bytes | Plain gzip stream, no tar inside. |
| stored.7z | 7z | 303 bytes | A format whose metadata sits after the payload, so a truncated copy loses the file list. |
sha256sum -c. Every file is generated from source, carries no third-party copyright, and is free to redistribute.Questions
What is Zip Slip?
A path traversal attack where an archive entry is named something like ../../etc/cron.d/task, so a naive extractor writes outside the directory you chose. It needs no exploit, only an extractor that joins paths without checking the result. The pack contains one.
Is the zip bomb in this pack dangerous?
No. It is deliberately modest: it expands enough to prove your decompression limit works and nowhere near enough to fill a disk. A real zip bomb is not something anyone should be handing out.
How should an extractor defend itself?
Resolve every entry path against the destination and confirm the result is still inside it after following symlinks. Limit total decompressed bytes and entry count, and abort as soon as either is exceeded. Never trust the sizes declared in the archive header.
Other packs
Upload Torture Test Pack · Filename Compatibility Pack · Encoding and Unicode Pack · Document Parser Pack · Image Pipeline Pack · Structured Data Pack · Email Parser Pack