Lion Cipher Lab
Crack a password-protected ZIP in your OWN lab
- Penetration Testing / Red Team
- Beginner
- ~50 min
- Free · no account required
Why it matters
People password-protect ZIP files all the time to email a batch of documents, back up records, or hand off files — and they usually assume 'it has a password, so it is safe'. Whether that assumption is true depends entirely on two choices most people never think about: how the ZIP was encrypted (the decades-old ZipCrypto scheme is weak; modern AES-256 is strong), and how strong the password was. If either is weak, the protection is closer to a sticker that says 'locked' than to an actual lock: the encrypted ZIP travels around as an ordinary file, and anyone who gets a copy can attack it…
What you'll learn
- understanding what an archive (a ZIP file) is and what it means to password-protect one
- understanding the difference between weak legacy ZIP encryption (ZipCrypto) and strong modern ZIP encryption (AES-256)
- opening a terminal and running commands with confidence, from zero
- installing John the Ripper (the jumbo build, which includes zip2john) and, optionally, fcrackzip on Windows, macOS, or Linux
- creating your OWN password-protected ZIP with a throwaway password you choose, holding only fake example files
- using zip2john to extract a crackable hash from a ZIP, and John the Ripper to recover the password from a wordlist
- using fcrackzip as an alternative to run a dictionary or short brute-force attack against your own ZIP
- seeing firsthand that weak, common, and short archive passwords fall almost instantly
- proving that a long, unique passphrase plus AES-256 encryption defeats the same attack
- stating the defender's rule: for anything you actually need to protect, use AES-256 and a long unique passphrase, never a short or common one
Steps in this lab
- First, the ground rules: your ZIP, your throwaway password, fake contents, nobody else
- What a password-protected ZIP actually is (from zero)
- Open a terminal (from zero)
- Install the tools: John the Ripper (with zip2john), and optionally fcrackzip
- Create your OWN password-protected ZIP with a weak password you choose
- Extract a crackable hash with zip2john
- Turn John loose: recover the weak password with a wordlist
- Why short and common passwords fall so fast
- Now make one that holds: AES-256 and a long unique passphrase
- What you proved, and the rule to carry