How to Crack a “Protected” ZIP File in Seconds – Why Passwords Fail

Event Overview

On 13 July 2026 red‑team researcher al1enr00t demonstrated cracking a password‑protected ZIP file in seconds using zip2john, John the Ripper and the rockyou.txt wordlist.

ZIP Encryption Weakness

ZIP archives support ZipCrypto (traditional) and AES‑256. Most tools default to ZipCrypto, an old PKZIP‑based scheme where the password generates a keystream that is XORed with file data. The archive header is stored unencrypted, enabling a known‑plaintext attack: an attacker can guess the keystream, validate candidates against the checksum, and confirm the correct password without exhaustive brute‑force.

Common passwords such as “123456”, “password”, “admin123” are readily recovered with a dictionary attack.

Toolchain

zip2john

zip2john extracts the encrypted hash from a ZIP file and formats it for John the Ripper. Example output:

target.zip:$zip2$*0*3*0*a7b3c2d1...::.:target.zip

The hash contains only verification data (checksum), not the password itself.

John the Ripper

John processes the hash, iterates over each word in the supplied wordlist, applies the ZIP encryption algorithm, and compares the result with the stored checksum. The workflow is:

Load the zip2john hash file.

Take each candidate from the wordlist.

Run the ZIP encryption logic.

Compare the result with the checksum.

Output the matching password.

rockyou.txt

rockyou.txt is a public wordlist derived from the 2009 RockYou breach, containing over 14 million common passwords. Studies indicate that more than 50 % of typical user passwords appear in this list.

Full Attack Procedure

Step 1 – Extract the hash zip2john protected.zip > zip_hash.txt Step 2 – Launch cracking

john --wordlist=/usr/share/wordlists/rockyou.txt zip_hash.txt

John can test tens of thousands to millions of candidates per second; if the password is present in rockyou.txt it is recovered within seconds to minutes.

Step 3 – Retrieve password and unzip

john --show zip_hash.txt
unzip -P <cracked_password> protected.zip

The demonstration showed that when the password is included in rockyou.txt the entire process completes in a few seconds, illustrating the practical insecurity of ZipCrypto‑protected archives.