Hello, aspiring ethical hackers. In our previous blogpost, you learnt about various methods of password cracking. In this blogpost, you will learn about fcrackzip, a tool that can crack passwords of zip archives. Frackzip is a fast password cracker written in assembler. It can crack password protected zip archives using brute forcing or dictionary based attacks.
This tool is useful for pen testers while doing pen tests, ethical hackers and even cyber forensic experts. Sometimes in the course of a pen test or a cyber forensic investigation, you encounter password protected zip archives. They may be backups or confidential files. Cracking the password of the password protected archives can reveal information that can be helpful further in a pen test. That’s where fcrackzip comes real handy.
Let’s see how fcrackzip works. For this article, I will be using Kali Linux on which this tool is installed by default. We also need a password protected zip archive as shown below.
All you have to do to crack the passwords of the zip archive using fcrackzip is to give the below command.
fcrackzip <password protected zip archive>
This will bruteforce the password of the zip archive. This is same as using the brute force option which is set with ‘-b’ option.
Set the initial password to test or specify a dictionary(-p)
The ‘-p’ option of fcrackzip does two things. It can set initial password for brute forcing or it can be used to specify a wordlist while dictionary cracking.
Dictionary Cracking (-D)
You can set dictionary cracking by using option ‘-b’ as shown below.
Get a more detailed output (-v)
If you want a detailed and verbose output you can get it using the ‘-v’ option as always.
Characterset specification
You can also specify a character set you want to use while brute forcing with fcrackzip using the “-c” option as shown below. Here’s how we can set fcrackzip to use only numbers while brute forcing.
Here are the options you can set with ‘-c’.
a: Include all lowercase character.
A: Include all uppercase charcater.
I: Include digits (0-9)
!: Include symbols !:$%&/()=?{[]}+*^#
Verifying the cracked password
Till now you have seen that fcrackzip found many passwords. Well, all of them are not the correct passwords. Just like any password cracker there will be false positives while using this tool. We can weed out this false positives using unzip to extract the archive using the password fcrackzip claims to be found.
Specify the length of the password to use for cracking (-l).
Using this option, you can set the length of the password to use for brute forcing as shown below.
That’s how you use fcrackzip to crack password protected zip archives.
Follow Us
