Cracking ZIP Passwords with John the Ripper

[Luckyy]

How to Crack ZIP Passwords Using John the Ripper

Legal Notice: This guide is for educational purposes only. Only use this on ZIP files you own or have explicit permission to test. Unauthorized access is illegal.

Requirements:

• John the Ripper (Jumbo version recommended)
• zip2john (included with Jumbo)
• A password-protected .zip file

Step 1: Install John the Ripper (Jumbo Version)

On Kali Linux or Debian-based systems:

sudo apt update
sudo apt install john

Or compile Jumbo from source:

git clone https://github.com/openwall/john.git
cd john/src
./configure && make -s clean && make -sj4

Step 2: Extract the Hash with zip2john

zip2john secret.zip > zip_hash.txt

Replace secret.zip with your ZIP file.

Step 3: Crack the Password with John

john zip_hash.txt

Step 4 (Optional): Use a Custom Wordlist

With the rockyou.txt wordlist:

john --wordlist=/usr/share/wordlists/rockyou.txt zip_hash.txt

With rules:

john --wordlist=rockyou.txt --rules zip_hash.txt

Step 5: Show the Cracked Password

john --show zip_hash.txt

Troubleshooting:

• "No password hashes loaded": Check if zip2john output is valid.
• Some ZIPs use AES encryption — try fcrackzip or hashcat instead.
• Always match directory paths or use full paths to files.

Conclusion

This guide works for ZIPs using legacy encryption. For stronger encryption like AES, consider GPU-based tools such as hashcat.