Documentation

Decompression Bomb (ZIP)

Creates a ZIP archive containing highly compressible data. The compressed size is tiny but decompresses to a huge file, causing resource exhaustion.

ZIP Slip (Path Traversal)

Creates a ZIP archive containing entries with path traversal in the filename. When extracted without sanitization, files are written outside the target directory.

Symlink Archive (TAR)

Creates a TAR archive containing symlink entries pointing to sensitive files. When extracted, the symlinks expose files outside the extraction directory.

DOCX XXE Injector

Injects XML External Entity (XXE) payloads into DOCX files to test for XXE vulnerabilities in Word document parsers.

PDF JavaScript Injector

Generates PDF files with embedded JavaScript that executes when opened in Adobe Acrobat Reader.

PPTX XXE Injector

Injects XML External Entity (XXE) payloads into PPTX files to test for XXE vulnerabilities in PowerPoint presentation parsers.

XLSX XXE Injection

Injects XML External Entity (XXE) payloads into XLSX files to test for XXE vulnerabilities in spreadsheet parsers.

GIF Comment Payload

Injects payload strings into GIF89a comment extension blocks for testing image parsers.

JPEG EXIF/Comment Payload

Injects payload strings into JPEG COM (comment) markers for testing image parsers and metadata extraction.

PNG Comment Payload

Injects payload strings into PNG metadata text chunks (tEXt, iTXt, zTXt) for testing image parsers.

SVG XSS/XXE Generator

Generates SVG files with embedded XSS (script, onload, event handler) or XXE payloads for testing image upload and rendering pipelines.

JPEG/HTML Polyglot

Generates a file that is both a valid JPEG image and renderable HTML. Useful for testing content-type sniffing and dual-interpretation vulnerabilities.

PDF/JS Polyglot

Generates a file that is both a valid PDF document and valid JavaScript. When loaded via <script src>, the JS payload executes.

PNG/ZIP Polyglot

Generates a file that is both a valid PNG image and a valid ZIP archive. PNG parsers see the image; ZIP tools can extract embedded files.