Python ZIP Password Recovery (Fragment Combination Brute-Forcer)

pass.py

"""
ZIP Password Fragment Brute-Forcer
----------------------------------
Description: 
Recovers lost ZIP file passwords by testing all possible combinations 
of user-provided text fragments (e.g., known words, dates, symbols). 

Features:
- Memory efficient: Generates combinations on-the-fly using itertools.
- Scalable: Tests increasing lengths of combinations automatically.
- False-Positive Protection: Includes zlib data verification to ignore 
  fake decryption successes inherent to the old ZipCrypto format.

Note: This script only works on standard ZIP encryption (ZipCrypto). 
It does not support AES-256 encrypted ZIP files.

Usage: Update the 'CONFIGURATION' variables below before running.
Generated via Gemini 3. 
"""

import zipfile
import itertools
import zlib  # Added to catch decryption errors from false positives

# --- CONFIGURATION ---
zip_path = "myzip.zip"
fragments = ["2024", "python", "test", "@"] 
min_length = 1
max_length = 5  # It will test combinations 2, 3, 4, and 5 fragments long
# ---------------------

def attempt_crack():
    count = 0
    try:
        with zipfile.ZipFile(zip_path) as zf:
            # Find the first actual file in the ZIP (skip directories)
            target_file = None
            for name in zf.namelist():
                if not name.endswith('/'):
                    target_file = name
                    break
            
            if not target_file:
                print("Error: No readable files found inside the ZIP.")
                return False

            for length in range(min_length, max_length + 1):
                print(f"\n--- Testing combinations of length: {length} ---")
                
                for combo in itertools.product(fragments, repeat=length):
                    password = "".join(combo)
                    count += 1
                    
                    # Print every 500th attempt to show it's working
                    if count % 500 == 0:
                        print(f"Attempt #{count}: {password}")

                    try:
                        # 1. Attempt to extract the file
                        zf.extract(target_file, pwd=password.encode('utf-8'))
                        
                        # 2. VERIFICATION: Actually read the data to confirm it's not a false positive
                        with zf.open(target_file, pwd=password.encode('utf-8')) as f:
                            f.read(1024)  # Try to read the first 1KB
                            
                        # If we make it here without throwing an error, the password is real
                        print(f"\n{'*' * 30}")
                        print(f"SUCCESS! Password: {password}")
                        print(f"Total attempts: {count}")
                        print(f"{'*' * 30}")
                        return True
                        
                    except (RuntimeError, zipfile.BadZipFile, zlib.error):
                        # zlib.error catches the false positives!
                        continue
                        
    except FileNotFoundError:
        print(f"Error: '{zip_path}' not found.")
        return False

    print(f"\nFinished. Tested {count} combinations. No match.")
    return False

if __name__ == "__main__":
    attempt_crack()