When building secure web applications, file upload validation is one of the most overlooked yet critical aspects of security. Many developers rely on file extensions (like .jpg, .pdf, or .txt) to validate uploads. While extension-based checks are easy to implement on both the client and server side, they are not foolproof.

⚠️ Why File Extension Validation Is Not Enough

File extensions can easily be manipulated. For example:

A malicious user can rename malware.exe to invoice.pdf and upload it to your web application.

If your application stores or executes uploaded files without further inspection, this can lead to severe security threats, including:

• Arbitrary code execution

• File inclusion attacks

• Server compromise

To protect your system, it’s essential to validate the file content — not just the name.

✅ Deeper Validation Using File Signatures (Magic Numbers)

A file signature (also called a “magic number”) is a specific sequence of bytes at the beginning of a file that identifies its format. This technique is more reliable than checking extensions.

✅ For Windows Executable Files (EXE):

All Windows/DOS executable files start with a magic number:

• Hex value: 0x4D 0x5A

• ASCII representation: MZ (stands for Mark Zbikowski, Microsoft architect)

Thumb Rule: If a file begins with MZ, it is likely an executable file, regardless of its extension.

Here’s a simple C# snippet that reads the first two bytes of an uploaded file to check if it’s an .exe:

public static bool IsExeFile(byte[] FileContent)
{
    var twoBytes = SubByteArray(FileContent, 0, 2);
    return ((Encoding.UTF8.GetString(twoBytes) == "MZ")||(Encoding.UTF8.GetString(twoBytes) == "ZM"));
}

private static byte[] SubByteArray(byte[] data, int index, int length)
{
    byte[] result = new byte[length];
    Array.Copy(data, index, result, 0, length);
    return result;
}

You can use this logic in your server-side file upload handler to reject disguised executables, even if they’re renamed as .txt, .jpg, or .pdf.

Additional File Upload Security Tips:

• Use MIME type validation (e.g., via server-side libraries)
• Scan uploaded files using antivirus APIs (e.g., ClamAV, VirusTotal)
• Store files outside the web root
• Rename uploaded files using secure hashes (e.g., SHA256)
• Restrict file size and types strictly
• Set correct file permissions (chmod, ACLs)

For enterprise or public-facing applications, a hybrid approach combining magic number checks, antivirus scanning, and strict access control is ideal.