Cracking a Password-Protected ZIP File with John the Ripper — A Hands-On Guide

Disclaimer:

This guide is intended for educational purposes only. All demonstrations and techniques discussed here should only be performed on systems you own or have explicit permission to test. Unauthorized hacking is illegal and unethical.

Please use this knowledge responsibly — become a better defender, ethical hacker, or bug bounty hunter.

John the Ripper (often called “John” or JtR) is a powerful, flexible password-cracking tool used by security professionals, CTF players, and bug bounty hunters alike.

Originally designed to crack Unix password hashes, it has evolved into a multi-format beast capable of cracking:

John works using dictionary attacks, brute-force, or rule-based attacks.

You’ve found a password-protected file, backup.zip, while exploring a target during a bug bounty recon phase. Time to crack it and see what’s inside.

Let’s walk through the process together.

Here’s the quick flow we’ll follow:

Start by converting the ZIP file into a hash that John understands:

This creates a hash.txt file with a special hash format for John to work with.

Now give that hash to John, along with a wordlist like the good ol’ rockyou.txt:

John will start comparing hashes from the ZIP with passwords from your wordlist.

📣 You’ll see output like:

Let it do its thing. If the password is in the wordlist, it’ll be cracked quickly.

Once it’s done (or instantly cracked), display the password:

Output might look like this:

✔️ And there it is — you’ve got the key.

Now you can extract the contents:

That’s it — you’re in!

If you want to streamline it, you can automatically pull the password from the crack output like this:

Handy for scripting or chaining this into a workflow.

Let’s say you’re browsing a misconfigured open directory or subdomain. You spot a backup.zip, download it, and it’s password-protected.

You run this cracking flow and inside you find:

You now have a high-impact finding to report — sensitive data exposure due to weak password protection. Even better if the same password works elsewhere (login portals, admin panels, etc.).