I have a website that allows the user to upload files. The front-end (web tier) checks the file extension and first few bytes of the file for the magic number of an acceptable file, but then downstream a more thorough backend process scans the full contents of the file using a server-side virus scanner and file contents scrubber.
I have access only to the web front-end and I need to push a file through the upload functionality, such that:
- The file extension is .doc, .docx, .pdf, .tiff, or .tif
- The magic number of the file (the first ~4-6 bytes, depending on the file type) corresponds to the expected magic number for the extension (these first two bullets are required for the front-end to not immediately throw away the file when it's uploaded)
- The contents of the file do not actually have the potential to cause any harm to someone if opened (that is to say, a good virus scanner SHOULD detect a virus, but the contents should actually be completely harmless, like the EICAR test string)
- The file is short enough to conveniently be injected into the HexView of Fiddler during the HTTP POST request involving the file upload, because I can't download it into a file on my system and upload it because McAfee would detect it and I can't disable McAfee on my system
- (Ideally) all the data in the file can be represented as printable UTF-8 characters
The virus scanner in use is from McAfee I believe, and should have a similar virus database, updated frequently.
I tried appending the EICAR string to a .tiff file, but this failed because the EICAR string is not supposed to be flagged as a virus if it is not starting from the beginning of a file (ignoring whitespace). Since the magic number of TIFF/PDF/DOC/DOCX is there at the front, the virus scanner does not think it is malicious.
How can I perform this test without triggering the virus scanner on my client and without downloading an actually harmful file?