When you find a ZIP/RAR file with password protected in the evidence, you may try dictionary attack or bruteforce attack or Rainbow talbes... Usually those attack will take a very very long time and end with fail. What will you do then? Allow me to remind you that there is still one thing you can do:"known plaintext attack".
What is "known plaintext attack"? Let's say when you use ZIP/RAR archiver to archive some files, and set password to protect this archive file. Those files in this archive now have something in common: the "key" generated when archiving.
So we could assume that some of files in that password-protected ZIP/RAR file are still in the hard drive. What we need is only one of those files so we could start known plaintext attack. Maybe some would say "I don't know which file is one of them?". Fine, all you need to do is gather some documents/pictures that have something to do with our suspect. Use the same ZIP/RAR archiver, of course the same version and the same method, to archive those files you gatehered from suspect's hard drive. Remember do not set password!!!
We have two files. One is the password-protected ZIP/RAR file, and the other is the ZIP/RAR file with no password-protected. Now you could understand why "known plaintext attack" works because all we have to do is to compare these two archive files, then we could get the key generated in the first place.
You could use Passware kit or Advanced Archive Password Recovery to proceed known plaintext attack. You will be very surprise that the speed is very fast. It won't take long and you could see the result on the screen. To everybody's surprise, it only takes one minute and forty-two seconds.
Next time you find password-protected ZIP/RAR files in the evidence, don't forget "known plaintext attack"!!!
Known plaintext attack的更多相关文章
-
Vulnerability of SSL to Chosen-Plaintext Attack 读书报告
这篇文章讲述了在SSL上的选择明文攻击.我想分四个部分讲讲我对这篇文章的理解. 1.CPA的定义: 2.文章讲述SSL相关基本概念漏洞: 3.对SSL的CPA攻击的过程: 4.实现这种攻击的可能性以及 ...
-
前端学HTTP之摘要认证
前面的话 上一篇介绍的基本认证便捷灵活,但极不安全.用户名和密码都是以明文形式传送的,也没有采取任何措施防止对报文的篡改.安全使用基本认证的唯一方式就是将其与SSL配合使用 摘要认证与基本认证兼容,但 ...
-
https那些事儿
(一)SSL/TLS协议运行机制的概述 一.作用 不使用SSL/TLS的HTTP通信,就是不加密的通信.所有信息明文传播,带来了三大风险. (1) 窃听风险(eavesdropping):第三方可以获 ...
-
zip压缩包密码破解
有一种破解方法叫做Known plaintext attack.市面上的密码破解软件几乎都带有这个功能.操作方法就是找到加密压缩包中的任意一个文件,用同样的压缩软件同样的压缩方式压缩成一个不加密的包, ...
-
转:Natas Wargame Level28 Writeup(EBC加密破解)
From:http://alkalinesecurity.com/blog/ctf-writeups/natas-28-getting-it-wrong/ Now that I knew it was ...
-
浅谈IM软件怎样建立安全socket连接、登录
----------------------------------------------------欢迎查看IM软件业务知识<专栏>-------------------------- ...
-
Security+学习笔记
第二章 风险分析 风险管理 评估:确定并评估系统中存在的风险 分析:分析风险对系统产生的潜在影响 响应:规划如何响应风险的策略 缓解: 缓解风险对未来安全造成的不良影响 风险分析流程 资产确定 漏洞确 ...
-
破解压缩包的几种方式(zip伪加密 爆破 CRC32碰撞 已知明文攻击)
zip伪加密 zip文件是由3部分组成,详见文末 压缩源文件数据区+压缩源文件目录区+压缩源文件目录结束标志 在压缩源文件数据区有个2字节的 全局方式位标记 ,在压缩源文件目录区也有个2字节的 全局方 ...
-
密码学笔记——zip明文攻击
明文攻击(Known plaintext attack):是一种攻击模式,指攻击者已知明文.密文及算法,求密钥的过程. 例题: 这就是一个坑 密码是十位大小写字母.数字.特殊符号组成的,你爆破的开么? ...
随机推荐
- virtualbox 虚拟机Ubuntu 传文件-共享
-
java中nextLine()和next()的区别
>概述 在实现字符窗口的输入时,我个人更喜欢选择使用扫描器Scanner,它操作起来比较简单.我发现用Scanner实现字符串的输入有两种方法,一种是next(),一种nextLine(),但是 ...
-
hdoj 1729 Stone Games(SG函数)
题目链接:http://acm.hdu.edu.cn/showproblem.php?pid=1729 看了题目感觉像Nim,但是有范围限制,有点不知道SG函数该怎么写 看了题解,最后才明白该怎么去理 ...
-
微软职位内部推荐-Senior Software Development En
微软近期Open的职位: Job Title: Senior Development Engineer Division: Visual Studio China - Developer Divisi ...
-
net programming guid
Beej's Guide to Network Programming Using Internet Sockets Brian "Beej Jorgensen" Hallbeej ...
-
Php RSS
RSS 聚合最近非常流行,因此至少对 RSS 及其工作方式有所了解是一名 PHP 开发人员的迫切需要.本文介绍了 RSS 基础知识.RSS 众多用途中的一些用途.如何使用 PHP 从数据库创建 RSS ...
-
JS闭包的概念
原文地址:http://zhidao.baidu.com/link?url=f81iaijX6nzY99Wz43v-p_qZEn4cCaomT4LD6NH5jVtI0yK2V76VJWefih51vA ...
-
ruby正则表带式对象使用备忘
ruby对于正则表达式的使用是非常灵活的,提供了专门的正则表达式对象Regexp.其包括match实例方法,字符串也含有该方法.so可以这么做: /a/ =~ "a" " ...
-
remote: Incorrect username or password ( access token )
解决问题 进入控制面板 用户账号,选择管理您的凭据 修改凭据 修改完成后,保存即可
-
android 通过修改图片像素实现CircleImageView
CircleImageView实现方法有很多种,各有优缺点,因此需要按照不同的场景使用.我们今天使用修改图片像素的方法实现CircleImageView,主要知识点无非是勾股定理和点到圆形的距离. 素 ...