Comment on page
ZIPs tricks
- Do you work in a cybersecurity company? Do you want to see your company advertised in HackTricks? or do you want to have access to the latest version of the PEASS or download HackTricks in PDF? Check the SUBSCRIPTION PLANS!
There are a handful of command-line tools for zip files that will be useful to know about.
unzipwill often output helpful information on why a zip will not decompress.zipdetails -vwill provide in-depth information on the values present in the various fields of the format.zipinfolists information about the zip file's contents, without extracting it.zip -F input.zip --out output.zipandzip -FF input.zip --out output.zipattempt to repair a corrupted zip file.
One important security-related note about password-protected zip files is that they do not encrypt the filenames and original file sizes of the compressed files they contain, unlike password-protected RAR or 7z files.
Another note about zip cracking is that if you have an unencrypted/uncompressed copy of any one of the files that are compressed in the encrypted zip, you can perform a "plaintext attack" and crack the zip, as detailed here, and explained in this paper. The newer scheme for password-protecting zip files (with AES-256, rather than "ZipCrypto") does not have this weakness.
- Do you work in a cybersecurity company? Do you want to see your company advertised in HackTricks? or do you want to have access to the latest version of the PEASS or download HackTricks in PDF? Check the SUBSCRIPTION PLANS!
Last modified 7mo ago