7z

OVERVIEW

7z is the command-line interface to 7-Zip (7-zip.org): it lists, tests, and extracts a long list of archive formats — zip, 7z, tar, gzip, bzip2, xz, and, with the right build, rar — from one binary. On a pentest box it is the default way to peek inside an archive before deciding whether the contents are worth extracting at all.

`7z l` prints the file list, sizes, and timestamps without writing anything to disk. That matters when the archive is large, password-protected, or might unpack a tree you do not want next to the rest of the engagement notes. Extract into an isolated directory, then treat whatever comes out under the same handling rules as the rest of the loot.

USE CASES

Practical use cases

• 01

  Listing the contents of a backup zip or 7z found on a share before extracting anything.

• 02

  Unpacking a vendor archive or source drop that arrived as part of scoped source review.

• 03

  Extracting a password-protected archive once the client has provided the password in scope.

• 04

  Confirming that a "deleted" path inside an archive still holds a config, key, or dump.

QUICK START

When a zip, 7z, rar, or similar archive turns up on a share, in a backup, or on a compromised host, and you need to see what is inside without unpacking it blindly.

1. Confirm the archive file itself is in scope to open, and that extracted contents stay inside the agreed data-handling rules.
2. List first with 7z l so you know what would land on disk.
3. Extract into a dedicated directory, not into the working notes or a shared drop folder.
4. Record which members you opened; delete the extract when the finding is written up.

7z l loot.zip

BEFORE YOU RUN IT

What to check before running it