Wrong MIME Type File — Extension Mismatch
Download a file that has a .jpg extension but actually contains HTML content. This simulates a common attack vector and data handling error where file extensions don't match the actual content. Use it to test MIME type detection, file upload security validation, content-type sniffing, and server-side file type verification.
What Is Broken
The file is named with a .jpg extension and may be served with an image/jpeg Content-Type header, but its actual content is HTML markup. The magic bytes do not match any image format signature.
Broken Example
<!-- This file is saved as .jpg but contains HTML -->
<html>
<body>
<h1>This is not an image</h1>
<script>alert('MIME type mismatch!')</script>
</body>
</html>Why It Matters
Extension/content mismatches are a security risk. Attackers upload HTML or SVG files disguised as images to trigger XSS attacks via MIME sniffing. Proper content-type validation based on magic bytes (not just extension) is essential for upload security.
Expected Parser / Validator Behavior
Servers should validate file content against the claimed type using magic byte detection. Browsers with X-Content-Type-Options: nosniff should refuse to render HTML served as image/jpeg. Upload handlers should reject mismatched files.
Related Invalid Files
Related Validators & Tools
Valid Sample Files
Frequently Asked Questions
Why is this a security risk?
If a server serves this file as image/jpeg without X-Content-Type-Options: nosniff, some browsers may MIME-sniff the HTML content and execute the embedded script, enabling XSS attacks.
How should uploads validate file types?
Check magic bytes (file signatures), not just extensions. Use libraries like file-type (Node.js) or python-magic to detect actual content type regardless of the filename.