unzip -l suspicious.zip For repeated use, save this script as zipcrack.sh :
zip2john protected.zip > zip_hash.txt This tool extracts the hashed password from the archive. For modern AES-256 encrypted ZIP files, zip2john will still work, but the resulting hash format is different (often starting with $zip2$ ). With the hash file ready, use John in dictionary mode:
zipdetails archive.zip | grep "Compression method" Output should show AES-256 .
