2022 Developer Survey is open! Take survey.

Questions tagged [zip]

An archive file format that is used to bundle multiple files and folders together that may have been compressed.

Filter by
Sorted by
Tagged with
0 votes
0 answers
55 views

Can unzipping archive by itself cause malware execution? [duplicate]

It it possible to execute a malware just by unzipping a malicious zip archive? Like a malware would target some vulnerability in zip decompression routine. How common such an exploit would be in the ...
user avatar
0 votes
1 answer
244 views

john failed to crack .zip file? [duplicate]

I have a .zip file and I want to crack its password using john. first I use zip2john: then I use john for cracking the password: but after 10 seconds, john stop cracking and exit. what's wrong?
user avatar
  • 1
18 votes
1 answer
4k views

Crack 7Z password if I also have the original file

Some of my files have been encrypted by ransomware. I can find some backup of files (unfortunately not all of them). Can I find the password of the 7Z zipped+encrypted files if I also have some of the ...
user avatar
  • 283
0 votes
0 answers
120 views

What is more secure: encrypting individual files in archive or encrypting the archive itself?

Let's assume we have symmetric crypto with the same IV for each operation. From my perspective, encrypting the whole archive is better, as similar strings are compacted and the CBC will work for us ...
user avatar
  • 101
1 vote
1 answer
530 views

Can I get malware from a .rar file without opening it in Android?

I was on a group with almost 200k people on it in Telegram. One of these members (probably new, his account is now deleted) sent me (and to other people too) a file named "Customer deposit H.rar&...
user avatar
0 votes
1 answer
110 views

Is checking zip content on another PC enough to prevent data leak?

Let's say I have two kind of files on my Windows desktop - first are files that can be published and shared with other people, second kind is confidential and should remain private. To share files I ...
user avatar
  • 45
1 vote
2 answers
122 views

Site password being used to secure ZIP download, are they storing my password in plaintext?

Recently a utility provider has started to attach a zip file including my bill inside, however, they have secured the zip file using my online web account password. I am not too concerned about ...
user avatar
1 vote
1 answer
327 views

zip password cracking with permutation

I have a zip file (.zip created by 7zip v15.10) that I remember the password to (~12 characters long), but it seems I've typed the password wrong while zipping it and now it doesn't open. What are the ...
user avatar
2 votes
0 answers
174 views

Zip Slip path traversal and consistent vulnerability checks

According to multiple sources such as snyk and infoq, preventing a "Zip Slip" vulnerability in Java can be achieved by denying writes outside the target directory: String ...
user avatar
  • 121
1 vote
0 answers
460 views

How to safely open two large files (.rar and zip) from google drive on mac?

I have two archived files which were shared with me on google drive. Im using a mac. Both are 9GB if I'm remembering correctly. The files are too large for google to scan for viruses, and too large to ...
user avatar
0 votes
2 answers
163 views

Is it possible to find a zip password if it is being generated locally?

I have a program that generates a zip file with a password. Is it possible to determine the password if you analyse the program as it is being run? Would calls to function libraries show the password ...
user avatar
  • 1
0 votes
0 answers
156 views

Rar (Zip) Decryption, how does it work

I was wondering how rar decryption works. I know that when I enter a password to encrypt my rar file, my password is derived into a key that is used to encrypt the rar file. But how does the ...
user avatar
1 vote
1 answer
255 views

Can I consider files compressed with password safe at all?

A follow up to my 7,5 years old question. Back 10-15 years ago, when I wanted to send an executable file over Gmail from my PC, all I had to do was to change file's extension to some meaningless one ...
user avatar
  • 3,287
2 votes
2 answers
660 views

Which encryption cypher is used when using zip -e?

I am looking for a cross-platform way to encrypt credentials I need to send to a client. I know encrypted zip archives leak metadata and can be tampered with, but how strong is the encryption cypher? ...
user avatar
2 votes
2 answers
3k views

Is it feasible to recover a zip file password consisting of about 16 digits?

A friend of mine lost the password of a zip file of her. She remembers that the password contains digits only (that is, only 0, 1, 2, 3, 4, 5, 6, 7, 8, and 9) and is 16 characters long or so. The ...
user avatar
  • 155
1 vote
0 answers
383 views

Recovery of files from a zip containing a directory (unencrypted) and 3 files (encrypred - ZipCrypto Deflate), possibe use of bkcrack?

I have a zip file, Example.zip consisting of a directory Example and three files *.dat. I can see the names of all 3 files. The dat files are encrypted (ZipCrypto Deflate). I'm interested to know if I ...
user avatar
31 votes
2 answers
9k views

How do unzip programs check if the password is correct?

It obviously doesn't connect with any sort of database. How is this even possible?
user avatar
  • 469
-1 votes
1 answer
451 views

Recover AES256 zip password by known result

I have a zip file containing an unencrypted folder with encrypted files inside. Given that for some files I have their originals, is it possible to restore the password used for encryption?
user avatar
  • 101
1 vote
1 answer
171 views

Recover password of ZIP archive, having its decrypted and extracted content

Can I recover a password of an AES-encrypted ZIP if I know its extracted & decrypted content? The archive contains two files protected with two different passwords.
user avatar
  • 11
1 vote
1 answer
7k views

How to recover lost zip file password?

I have a folder with very important files on my computer and I zipped it with a password for security reasons. Unfortunately, I'm not able to recover the password. Usually, I always use the same kind ...
user avatar
0 votes
1 answer
295 views

Is ZIP-attack possible/realistic? [duplicate]

I was recently visiting a semi-popular website by just typing the link into the browser. I actually was sure that I typed the right address in there. But what if I typed in the wrong address and then ...
user avatar
  • 1
1 vote
2 answers
4k views

Is it risky to download but not use a zip file?

Is there any possibility of malware infection in Windows 10 for the following three situations: When you download a zipped file, but do not use it (you do not open it)? When you only open a zipped ...
user avatar
0 votes
1 answer
2k views

Recover corrupted password protected Zip

Good evening. I have a password protected zip archive (Zip 2.0 CryptoZip) with a .txt file with sensitive info inside. The problem is that I can't extract it. 7Zip:"Data error : Wrong password?" ...
user avatar
0 votes
2 answers
1k views

Can a PowerShell script inside a Zip file execute automatically upon unzipping?

I have a zip file that has a Powershell script inside that I want to look at. Is it possible that the Powershell script could execute automatically just by unzipping the file? This is not something I ...
user avatar
  • 1
13 votes
3 answers
7k views

How long should zip encryption password be for it take 10 years to crack?

I am using zip 3.0.0 on macOS High Sierra and Ubuntu. Here is my zip version on macOS: $ zip --version | head Copyright (c) 1990-2008 Info-ZIP - Type 'zip "-L"' for software license. This is ...
user avatar
21 votes
2 answers
4k views

At which point can a system be compromised when downloading archived data from an untrusted source?

If I download archived data from a possibly untrusted source at which point am I at possible risk of harming my system: Initially downloading and saving the archived data (still packed) Unpacking the ...
user avatar
  • 329
1 vote
1 answer
630 views

Lost RAR password, is there any way to access my data? [closed]

I lost my winrar password of my file. I need to access it. Is it possible? If yes, how?
user avatar
  • 21
2 votes
1 answer
293 views

If I unzip a password-protected zip file, will the person I downloaded it from be notified in anyway?

If I access a password protected zip file, that i've downloaded through tor, and then opened the zip file, is there any way the person who posted the zip file would be able to find out that I've ...
user avatar
  • 21
5 votes
1 answer
4k views

Encryption Using 7z or Zip File

I'm wondering which encrypted 7-Zip file format has better encryption: 7z with 256 AES or zip file with 256 AES? Assume that a strong password is used, then which encrypted 7zip file format has ...
user avatar
  • 67
2 votes
1 answer
2k views

Zip files and metadata

I want to send a zip of some files. The files themselves don't contain anything sensitive but I'm wondering if zip files contain metadata that could identify me or something about me? It seems that ...
user avatar
  • 31
1 vote
1 answer
14k views

Crack password protected zip file with pkcrack

I have allfiles.zip contains only file allfiles.exe and is password protected. I heard about pkcrack, it is possible to get the file from a zip file which is encrypted if we have some part of ...
user avatar
  • 113
1 vote
0 answers
113 views

rar and zip password encoding scheme [closed]

What encoding scheme is used in last versions of ZIP archives(6.3.2+) and RAR archives(3.90+), including RAR5? UTF-8/16, ASCII or something else?
user avatar
  • 161
7 votes
1 answer
3k views

How to protect websites against ZIP bombs and reference bombs?

A Zip bomb (concept here) seems quite a "smart" and easy vulnerability to websites where uploading ZIP files is allowed. Such sites are under a threat (at least to make some degree of damage to them) -...
user avatar
  • 2,667
0 votes
0 answers
122 views

Does WinRar leave cache of opened Zip Archives (Nothing extracted)

Downloaded a .zip, via a secure app that deleted the only place it was downloaded (supposedly, who knows if defragmentation left other traces, the download happened by accident, on main OS WIN10, no ...
user avatar
4 votes
2 answers
2k views

How does a zip file detect a correct password?

When extracting files from an encrypted zip archive, the user is asked to give a password in order to read the original file. How does an encrypted ZIP detect when the user has given the correct ...
user avatar
1 vote
1 answer
1k views

Can unpacking a .zip file be harmful for Unix-like systems?

Let’s say there is a .zip file that contains either a virus, malware or something harmful for the computer. The computer is running a Unix-like OS, e.g. Ubuntu 18.04. Are there any security ...
user avatar
  • 151
1 vote
0 answers
206 views

Working with Security Metadata in APK file

According to this Blog post, Google has added a Security Metadata on top of an APK to verify that it was originally distributed by Google Play. More specifically it adds APK Signing Block to the APK ...
user avatar
  • 111
9 votes
3 answers
12k views

Can the content of a password protected zip file be known?

Let's suppose that I share an illegal copy of a material on web which is in password protected zip file, can the owner send me a copyright notice or know what's inside the zip without knowing the ...
user avatar
  • 93
-1 votes
1 answer
266 views

Can Zip files contain any information other than the bytes in the files being zipped?

We have a secure environment where we sometimes transfer large quantities of unclassified data between machines certified for classified operations. We zip these files to ease the process of data ...
user avatar
17 votes
1 answer
8k views

What encryption method is used by the zip program in macOS?

In order to send a file securely I am going to encrypt/password protect a zip file. (Why I am doing this). I am using macOS Sierra 10.12.6 and through my research I have concluded that encrypting a ...
user avatar
  • 640
1 vote
1 answer
113 views

Hard coded paths in archive files

I am just testing some web application. In this web application, I can upload some file at least as zip archive. I came to an idea to test, if I could place a file at a specific location I want. My ...
user avatar
  • 201
2 votes
3 answers
3k views

Susceptibility of 7z encrypted archive files to man in the middle attacks

Given: A file (assume 1 GB in size) is encrypted along with filenames using 7zip into a 7z archive using AES-256 The file is uploaded to a cloud storage service such as those offered by Google, ...
user avatar
  • 68
1 vote
1 answer
430 views

zap proxy - modify post to inject a zip file

I am doing a CTF image now, and I need to upload a .zip file to execute using the php wrapper zip:// using this PHP ZIP Wrapper LFI vulnerability The problem is that the only way to upload is with ...
user avatar
0 votes
2 answers
4k views

Reverse Engineering - .zip file decryption if I have similarly encrypted .zip files and I have password to one of them

Is this possible to somehow reverse engineer password to .zip file if I have 2 similarly encrypted .zip archives, both need 20-sign password (that has big and small letters and numbers) so Brute Force ...
user avatar
6 votes
3 answers
9k views

Is it possible to read a text file inside a password-protected zip file without the password?

I have a text file (.txt) compressed in ZIP format protected by a password. I think it has only one line of text and I want to see the contents of this file. I tried fcrackzip but I think the ...
user avatar
  • 239
0 votes
1 answer
671 views

Using unencrypted parts of encrypted file to recover password (7zip)

I have forgotten the password for an encrypted 7zip file (the filenames are not hidden), and I have copies of some of the unencrypted files. Is there a way I can use this to find out what the password ...
user avatar
2 votes
0 answers
6k views

John the Ripper doesn't use my wordlist file properly

When I use JtR to crack an encrypted zip file I have, it seems like JtR doesn't go through the wordlist I have ... I do the following steps: $ brew install john-jumbo $ export PATH=$PATH:/usr/local/...
user avatar
8 votes
1 answer
7k views

Approaches to cracking an encrypted zip file

I'm taking part in a capture-the-flag exercise; the level of difficulty is competent, but non-expert. I'm not a security practitioner, but I do have a development background and a reasonable knowledge ...
user avatar
  • 183
7 votes
3 answers
8k views

Is it safe to click on zip or rar file? [duplicate]

Sometimes I'm in dilemma when I want to open archive file if there is any risk by opening it, because I'm not sure if attacker can use any trick that will trigger malware just by clicking on it. I'm ...
user avatar
  • 1,298
0 votes
1 answer
1k views

Security risks with handling ZIP archives in web applications

I'm researching possible security risks when handling ZIP files, or archives in general, in web applications. The scenario is the following. The user is able to upload any ZIP (or in general an ...
user avatar
  • 979