0

After a rainbow/hash table is salted, is it possible to resalt it after finding the correct salt instead of generating it all over again? If not, what is preventing you from doing so? How can you find the correct salt for something?

  • 1
    What do you mean, "after a table is salted?" When doing precomputation attacks on hashes, you don't compute a bunch of stuff and then add the salt; you need to use the salt as an integral part of building the table. – cpast Jul 1 '15 at 21:40
  • When I generated a table using genpmk, it asked for the SSID to salt it. Can you resalt it without computing ALL of the data over again to speed up the process? – WMPR Jul 1 '15 at 22:03
  • 1
    It needs the SSID before doing the computation of any salted hashes. It doesn't do the computation and then add the salt. – cpast Jul 1 '15 at 23:49
1

No. Every hash would have to be recalculated, essentially reproducing the work that was needed to create the original rainbow table.

Hashing is basically a mathematical formula. You have a formula (hashing algorithm) of X + 5 = Y, where X is the password and Y is the hash. You use a rainbow table to store all possible values of X with their Y results. If you change or add a salt then the formula is now different too (like X + 6 = Y). So while the values of X wouldn't have changed the values for Y would all be different and need to be recalculated.

Typically the salt is stored alongside the password hash in a database and is not intended to be a secret (at least to those with password database access). If it isn't stored there it is either stored elsewhere or is a known piece of information (username, system secret, SSID). The source code of the software that validates logins will typically reveal how the salt is obtained.

  • Ah. I understand now. Is that was hash cracking is for? To find information stored in a hash? What about passing the hash? There's a whole section in Kali specifically named "Passing the hash". – WMPR Jul 1 '15 at 22:18
  • 1
    You're asking for a bit more info than can be accommodated in a comment reply. I'd do searches for "password cracking" and "pass the hash" on this site to read more about these topics. – PwdRsch Jul 1 '15 at 22:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.