> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/creds/offline-attacks/specific-cracking-programs.md).
# Specific cracking programs
## Fcrackzip
**fcrackzip** is a fast password cracker partly written in assembler. It is able to crack password protected zip files with brute force or dictionary based attacks, optionally testing with unzip its results. It can also crack cpmask’ed images.
This package is useful for pentesters, ethical hackers and forensics experts.
### Cracking a password with dictionary
In this mode, **fcrackzip** can read passwords from a file that we provide; the file must contain one password per line and be alphabetically ordered for fcrackzip to function properly.
Using the command syntax below to use **fcrackzip** with a dictionary attack (`-D`) and the **rockyou.txt** wordlist (`-p`). It’s not necessary to create a hash file.
```bash
fcrackzip -u -D -p /usr/share/wordlists/rockyou.txt file.zip
```
### Cracking with specific charsets
To use a brute force attack, fcrackzip is a powerful and simple method for performing a brute force attack on any zip file. To do so, we would use various formats to break the zip file’s password. To do so, we’ll use `-b` to enable us to brute force the zip file, `-c` to describe the charset to use, and `-u` which allows us to see only the right outcome in the result.
```bash
fcrackzip -b -c 'a1' -u file.zip
```
The characters to use in brute-force cracking are:
```
a include all lowercase characters [a-z]
A include all uppercase characters [A-Z]
1 include the digits [0-9]
! include [!:$%&/()=?[]+*~#]
: the following characters upto the end of the spe-
cification string are included in the character set.
This way you can include any character except binary
null (at least under unix).
```
For example, `a1:$%` selects lowercase characters, digits and the dollar and percent signs.
### Usage information
fcrackzip -h
```bash
┌──(kali㉿kali)-[~]
└─$ fcrackzip -h
fcrackzip version 1.0, a fast/free zip password cracker
written by Marc Lehmann You can find more info on
http://www.goof.com/pcg/marc/
USAGE: fcrackzip
[-b|--brute-force] use brute force algorithm
[-D|--dictionary] use a dictionary
[-B|--benchmark] execute a small benchmark
[-c|--charset characterset] use characters from charset
[-h|--help] show this message
[--version] show the version of this program
[-V|--validate] sanity-check the algorithm
[-v|--verbose] be more verbose
[-p|--init-password string] use string as initial password/file
[-l|--length min-max] check password with length min to max
[-u|--use-unzip] use unzip to weed out wrong passwords
[-m|--method num] use method number "num" (see below)
[-2|--modulo r/m] only calculcate 1/m of the password
file... the zipfiles to crack
methods compiled in (* = default):
0: cpmask
1: zip1
*2: zip2, USE_MULT_TAB
```
## Pdfcrack
**PDFCrack** is a simple tool for recovering passwords from pdf-documents.
It should be able to handle all pdfs that uses the standard security handler but the pdf-parsing routines are a bit of a quick hack so you might stumble across some pdfs where the parser needs to be fixed to handle.
The main PDFCrack features are:
* Supports the standard security handler (revision 2, 3 and 4) on all known PDF-versions.
* Supports cracking both owner and userpasswords.
* Both wordlists and bruteforcing the password are supported.
* Simple permutations (currently only trying first character as Upper Case).
* Save and load a running job.
* Simple benchmarking.
* Optimised search for owner-password when user-password is known.
This program can be used in forensics investigations or similar activities, to legal password crack.
### Sample usage
With `pdfcrack` you don't need to get the hash first, this is done automatically.
```bash
┌──(kali㉿kali)-[/mnt/…/Wargames/FIRST_CTF/Forensics/pdfcrypt]
└─$ pdfcrack -f encrypted.pdf -w /usr/share/wordlists/rockyou.txt
PDF version 1.5
Security Handler: Standard
V: 2
R: 3
P: -4
Length: 128
Encrypted Metadata: True
FileID: 1db41bb48e9dd31ec67a3a29a274480e
U: 5bbb29f8836700ad2d4ad9329e76622b00000000000000000000000000000000
O: 8911d092254cfa6e8805d444732c3ebcbee4aaf98042d588eeac0e633f7c9ac1
found user-password: 'hacked'
```
The above cracking was really FAST!
### Usage information
pdfcrack
```bash
┌──(kali㉿kali)-[~]
└─$ pdfcrack
Usage: pdfcrack -f filename [OPTIONS]
OPTIONS:
-b, --bench perform benchmark and exit
-c, --charset=STRING Use the characters in STRING as charset
-w, --wordlist=FILE Use FILE as source of passwords to try
-n, --minpw=INTEGER Skip trying passwords shorter than this
-m, --maxpw=INTEGER Stop when reaching this passwordlength
-l, --loadState=FILE Continue from the state saved in FILENAME
-o, --owner Work with the ownerpassword
-u, --user Work with the userpassword (default)
-p, --password=STRING Give userpassword to speed up breaking
ownerpassword (implies -o)
-q, --quiet Run quietly
-s, --permutate Try permutating the passwords (currently only
supports switching first character to uppercase)
-v, --version Print version and exit
```
## Resources
Fcrackzip - Homepage:
Fcrackzip - Kali Tools:
Pdfcrack - Kali Tools: