Lion Cipher Lab
Read a phishing ZIP byte by byte and find the name the listing hides
- Digital Forensics & IR (DFIR)
- Intermediate
- ~60 min
- Free · no account required
Why it matters
Phishing emails very often deliver their payload inside a ZIP, because an archive hides the real file from a quick glance and from some mail filters. The usual first look is a listing: names, dates, sizes. That listing comes from one copy of the metadata, the central directory at the end of the file, and a ZIP keeps a second copy in front of every file's data. When the two disagree, different tools see different files. The same bytes also hold a host system byte, a spec version, timestamps with no time zone, and sometimes a second timestamp in UTC that reveals the builder's clock offset. This…
What you'll learn
- the three record types inside every ZIP: local file headers, the central directory and the end of central directory record
- decoding MS-DOS date and time words by hand: year since 1980, 2-second steps, no time zone
- reading the Info-ZIP extended timestamp extra field (0x5455) and using it to recover the builder's UTC offset
- reading the version made by field: which host system and which spec version the building tool declared
- comparing the central directory copy of every field against the local header copy, and catching a hidden file name
- writing a small ZIP structure parser with Python struct, and scoring it against zipfile -l and ZipInfo with an answer key
- listing what an archive cannot prove: who built it, when it was sent, and whether any timestamp is honest
Steps in this lab
- The case, and the words you need
- Open a terminal, check Python, and make a folder
- Build the evidence ZIP yourself, so it is safe and identical for everyone
- Look the way most people look first: the zipfile listing
- The map: how a reader finds everything, starting from the end
- Decode one header by hand before you trust any parser
- Write the parser: every record, both copies, every extra field
- Read the story the bytes prove
- Measure it: what the listing shows vs what the parser shows
- Forge it yourself, then write down what the archive cannot prove
- When to do this, when not to, and how a pro does it better