Even auto-extractors arriving as EXE files will be auto-expanded with the same logic.Īnytime you can hide something in a zip to 'get around a scanner', an attacker can do the same. It auto-expands zips to 12+ levels (while avoiding zip bombs), so hiding a zip within a zip doesn't work either. Double-extensions are not only reduced to the 'inside' extension (again, trapping it by name) but they are also expanded as well. zi_ will not work because it 'smells' the zip (looks at the file's structure and fingerprint). For instance, my spam/malware probe not only looks at file extension, it also looks at file type. I'd like to avoid requiring my clients to install any additional software or use third party websites on their end.

To clarify further: since I have control over my software running on offline client systems, and I control how the data files are created, I'd still like to explore options of how I might package my data to make it as easy as possible to email specifically. I'm looking for a good, simple solution for having clients email files to me. To clarify, I'm not worried about sending files out as I can host them on my own web server for download. What is the most straight-forward way to send a compressed file through email and avoid getting your attachment stripped out by over-eager firewalls?

I often have clients email zip files to me only to find out that their corporate firewall has stripped the attached file. It is not currently accepting new answers or interactions. This question and its answers are locked because the question is off-topic but has historical significance.

Zip encrypt file