Simple Brute Force Attack on Zip File Using Python
ZIP is an archive formatter that supports data compression. A ZIP file can be filled by one or more files or directories. The size of ZIP is smaller than the original one. It also support password protection, to protect our data from others. But, if you are somebody who likes making new password, sometimes you will forgot your old password even it’s the simplest one. It’s really annoying right.
The purpose of this article is how to deal with yourself when forget your protected zip file. Please note, it’s for your ZIP file not for other person. Any action into others file is beyond my responsibility. But, trust me, this method will help us a lot. Especially, when we really can’t remember the password that we input before. FYI, this is article I got from @xtremepentest
Okay, let’s go into the code
Okay, let’s make some protected file, here is the example, I want to protect three song into ZIP, in this case I give it password
Well, after successfully protect the file, it will ask us to put the password in every extraction just like the picture below
Okay, our protected file is ready, let’s go into the code section
Before all, this will use
zipfile module for doing the brute force attack and
tqdm modules for built a progress bar to make the attack more realistic.
from tqdm import tqdm
In case you are not yet install that two modules just run this in your terminal.
pip install tqdm
pip install zipfile
Next we will ask the user to input the zip file name and the wordlist for doing the dictionary attack.
protected_file = input("Zip file: ")
wordlist = input("Choose wordlist: ")
Wordlist is a collection of text that usually used in brute force attack. You can built manually, just save your file as
.txt file. Here is the example
I save the above wordlist as
my_wordlist.txt. After wordlist created, we need to check is the program is a ZIP file or not. If the program is a ZIP the code will run and if not the code will stop.
zip_file = zipfile.ZipFile(protected_file)
n_pass = len(list(open(wordlist, "rb")))
print("File not zip, exiting...")
In the code above, I also read all wordlist to know how many word will be used in the brute force attack. Finally, here we go into the final code when the attack happen.
print("Number of password that will be checked:", n_pass)
print('\n')with open(wordlist, "rb") as wordlist:
for word in tqdm(wordlist, total=n_pass, unit='word'):
print("[+] Password Found:", word.decode().strip())
print("[X] Password not found in the wordlist, try another one")
Well, using the
extractall function from
zipfile module the brute force will run until the end of the wordlist. If the password matched, it will prompt out the password. But, if not the brute force will be exit.
Okay, here is the documentation of the attack scenario that we had built before
Well, yeah the password is
password like we declared before. If you want some challenge, try to find this ZIP file password and tell me the answer.
In this article, I was sharing about how to make simple brute force zip file attack by implementing
zipfile modules. Please use this tutorial wisely for your life.
That’s all from me, thanks for reading. ✌