I have a zip file that I can't open since I forgot the password. I'm pretty sure of some parts of this password but I can't remember the variations I added to it. I tried fcrackzip but I can't see how to signify that I know parts of the password. To summarize:

  • I know some parts of the password, example "hello", "world" and "shittypass".
  • These parts can be in any order and not all of them may be used.
  • Some additional small parts may appear, like 3 to 5 lower case letters.

Do you know any software that can do that ?


Outline of method:

  1. Use a util like crunch to create a custom dictionary file.

  2. Run fcrackzip with that custom dictionary.


  • Up to 3 strings mixed with anywhere from 3-5 lower case letters makes upwards of a trillion possible passwords. Just generating that dictionary will take a while.

  • crunch permits using character-based wildcards, but its handling of custom strings is not as flexible. To solve this Q, grep, sed and sort also seem to be needed, any of which increases the time needed, i.e. hours, maybe days...

Something like this would probably work:

crunch 3 9 abcdefghijklmnopqrstuvwxyz123 | \
  grep '[123]' | # at least one number per dict entry
  egrep -v '([123]).*\1' | # remove repeated numbers
  sed 's/1/hello/;s/2/world/;s/3/shittypass/' | # replace numbers with strings
  sort -u | \
  fcrackzip -D -p /dev/stdin foo.zip 

Test case with a smaller problem set (one or two strings, and up to two lower-case letters, any order):

echo foo > bar.txt  # file to archive
zip -P xhellobworld baz bar.txt   # archive with password
time crunch 2 4 abcdefghijklmnopqrstuvwxyz12 | \
     grep '[12]' | egrep -v '([12]).*\1' | \
     sed 's/1/hello/;s/2/world/' | \
     sort -n | fcrackzip -u -D -p /dev/stdin baz.zip 


Crunch will now generate the following amount of data: 3163440 bytes
3 MB
0 GB
0 TB
0 PB
Crunch will now generate the following number of lines: 637392 

PASSWORD FOUND!!!!: pw == xhellobworld

real    0m5.942s
user    0m2.240s
sys 0m1.040s
  • Awesome. My combination would be less computationally expensive since I'm almost sure the random characters are at the end. Thx you. – Robin Jun 1 '17 at 11:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.