> ## Documentation Index
> Fetch the complete documentation index at: https://witchking.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Overview

> Safe Python-only parser for RAR5 archives targeting Alternate Data Streams.

Recent **WinRAR 0-day vulnerabilities** — including CVE-2025-8088 and CVE-2025-6218 — have highlighted how attackers abuse RAR archives in phishing campaigns.

Adversaries weaponize RAR archives by:

* Embedding **Alternate Data Streams (ADS)** inside files in the archive
* Using **malformed headers** or **XTRA blocks** to bypass detection
* Leveraging WinRAR parsing vulnerabilities to achieve **code execution** when archives are opened

Traditional tools like `unrar.exe` or WinRAR's GUI can be **dangerous to run** on malicious samples and may **not expose hidden ADS streams**.

> [!NOTE]
>
> **rarADSExtractor** provides a safe, Python-only parser for **Incident Responders, Threat Hunters, and SOC analysts**. [GitHub Repository](https://github.com/tasox/rarADSExtractor)

## Why This Matters for SOC/IR

| Benefit | Description |
| - | - |
| **Safe Analysis** | Avoids risky execution of WinRAR or `unrar.exe` |
| **Visibility** | Uncovers hidden ADS streams often abused in malware delivery |
| **Automation-Friendly** | Python-only, no external dependencies |
| **Detection & Hunting** | Quickly inspect suspicious archives from CVE-2025-8088 / CVE-2025-6218 campaigns |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.