Questions tagged [rainbow-table]
The rainbow-table tag has no usage guidance.
53 questions
1
vote
1
answer
193
views
Is there any benefit to use different salt for different encryption algorithms for same user
There is two different passwords for a single user.
I'm hashing both for future validation. I'm currently using a single unique salt for the user, but each is hashed with a different algorithms (...
- 111
0
votes
0
answers
82
views
What are the underlying mechanics that make password salting an effective deterrent against Rainbow Tables? [duplicate]
I have a top level familiarity with Rainbow tables (1 ,2 )
I also understand that salting adds a randomly generated alphanumeric string to each password before it gets hashed and put in a database.
My ...
0
votes
1
answer
360
views
Are dictionary and rainbow table attacks a subset of brute force attacks or are they seperate?
This is more of a question on the actual use of the terms rather than the definitions, so my question is this:
Are dictionary and rainbow table attacks a type of brute force attack or are they ...
- 103
0
votes
1
answer
805
views
Making already hashed wordlists of all possible combinations [duplicate]
Let us imagine a situation where a company stores its user passwords (let's ignore salts, etc for now) using some hash (say sha256) and the company gets breached. All of the username and password ...
- 1
3
votes
1
answer
1k
views
Why people say that salt helps to prevent rainbow table attack? [duplicate]
I am using some frameworks that store salts inside databases. For example this article shows how Devise stores salt together with the user information. My question is why do people say that salts ...
- 465
13
votes
3
answers
7k
views
How does a 'rainbow table' hacker obtain password hashes in the first place?
I don't understand this part of the Rainbow table attack.
In all my Google searches, it says that a hacker uses a rainbow table on password hashes.
But how does the hacker obtain the password hashes ...
- 256
0
votes
1
answer
198
views
When is it best to use a Rainbow Table attack? [duplicate]
Under what circumstances that a Rainbow Table attack is best used?
2
votes
2
answers
970
views
Can you help me with some misconceptions about bcrypt and salting?
I researched password hashing and cracking and I have some misconceptions:
First rule of thumb to create a strong password is to use 10+ combination of digits/upper/lower/symbols to prevent brute ...
2
votes
1
answer
1k
views
Why does pwdump7 retrieve LM hashes even though they're disabled?
I'm currently undergoing a penetration testing certification, where I'm asked to :
Set up a fully-patched Windows 10 Pro VM (done)
Retrieve local password hashes from the SAM database using pwdump7
...
- 123
0
votes
0
answers
150
views
Why people buy stolen databases with emails and hashed passwords of users? [duplicate]
I see every now and then how hackers stole DB with emails and hashed passwords of millions of users from popular websites and sell it on the black market.
I assume that passwords were hashed with ...
- 101
3
votes
1
answer
3k
views
Is there a difference between a rainbow table and a dictionary attack?
I'm trying to learn a bit more about the different types of attacks but as far as I understand it, a rainbow table is a large collection of prehashed data which is then compared to hashed data ...
- 33
-1
votes
1
answer
1k
views
Calculating Time for a Attack on Password Hashes [closed]
Suppose I have a database containing hashes. Hashes are obtained from password developed from randomly chosen set of 94 characters such that each password size is of 8 characters. So we have 94^8 ...
- 107
0
votes
1
answer
3k
views
Rainbow tables (MD5 and SHA-1) with all 8 char combinations [closed]
Can someone tell me the what length passwords have been hashed, in every possible combination, in rainbow tables? In MD5 and SHA1. Including all characters (letters upper and lower case, numbers and ...
0
votes
2
answers
647
views
Protect key-streched hashes from rainbow tables?
I have a database table with accounts. I'm using PBKDF2 to create hashes from passwords. The passwords are of the correcthorsebatterystaple type, so we assume they are secure and unique. There are no ...
- 517
2
votes
1
answer
251
views
Is there any benefit to using a salt when the cleartext is random data?
I understand that using a salt makes it harder to find cleartext using rainbow tables - but in that scenario the clear text is structured / low entropy. If my clear text is generated randomly, then is ...
- 18.8k
1
vote
1
answer
947
views
Iterated SHA1 hashing and the effect on rainbow table computation
Scenario:
1000 distinct keys are each prefixed with the same salt, and SHA1 hashed. The hash output is then iteratively SHA1 hashed x times. Let's start with x is 100.
The specification of the keys ...
- 113
2
votes
2
answers
1k
views
To build a rainbow table, how to decide size of chain and number of lines?
To be sure I well understood the Rainbow Tables, I've decided to make a little project in Java, but I"m stuck on a question : how to choose the size of the chain ? And this will give the number of ...
- 123
1
vote
2
answers
15k
views
Cracking passwords via hashcat or rainbow tables. Which is faster?
This is more of a theoretical rather than a practical question. To give a bit of background, the discussion at work has come up with what to set our password complexity to and what the logistics would ...
- 17
2
votes
1
answer
878
views
clarification on how rainbow tables use multiple reduction functions to avoid collisions
I understand how Hellman's time-memory trade-off tables work by creating chains of hash and reduction function results and storing the last result after a number of operations. since the reduction ...
- 279
3
votes
2
answers
9k
views
Should I use rainbow tables or bruteforce (NTLM)?
As part of security testing, I will receive around 150 to 200 Active Directory password hashes from Windows Server 2012 R2 (using NTLM?).
I have found NTLM rainbow tables (1,5 TB total), that covers ...
- 77
7
votes
4
answers
6k
views
Is there a way to check lists of cracked passwords without revealing my password?
I want check if my various passwords are in lists of cracked passwords, but I don't want to type the passwords online. For example, I'd rather scroll through an ordered list of passwords that have ...
- 173
5
votes
2
answers
234
views
Are stronger passwords safe in case of a breach?
Passwords are not generally held by websites, instead, they hold hashes of your passwords.
When there's a breach, these hashes are stolen and they are matched against rainbow tables of pre generated ...
- 159
1
vote
3
answers
2k
views
By how much does the addition of a salt slow down a rainbow table attack?
I understand that the addition of a salt provides some protection, because the attacker can no longer just look up the hash value in a rainbow table. However, it is still feasible to write a cracking ...
1
vote
1
answer
1k
views
How many combinations of md5sums can be computed from a call to random() in PostgreSQL?
Problem space
I'm way out of my pay grade, I'm trying to figure out
How much randomness does a call to random() actually provide in PostgreSQL?
SELECT random();
Whether or not you can reasonably ...
- 3,107
1
vote
0
answers
300
views
Generating Rainbow Tables with Salt/Prefix [closed]
I would need a tool that would allow me to create rainbow table for custom password pattern. The pattern is 9-XXXXXXXXX where X is alphanumberic character and 9- is fixed prefix, as well as fixed ...
- 11
1
vote
1
answer
770
views
Can a Rainbow Table find multiple plaintext passwords to match a given hash
Given that:
an MD5 hash can map to multiple plaintext strings (it is not unique)
a rainbow table may store several million plaintext passwords with matching hash
MY password is "password123", mapping ...
- 113
0
votes
2
answers
142
views
Does this count as unique salting against rainbow tables
**Due to the limitations of my situation the exe (i.e. source), hash, salt, everything is stored locally as it's a local application.
Would this idea beat rainbow tables?
Password = Input (always 8 ...
4
votes
3
answers
9k
views
Are rainbow tables a viable tool for cracking NTLMv2 hashes?
Background
I am unclear about the difference between NTLM hashes and the NTLM protocol, regardless of version.
My tentative understanding is that there is such a thing as an "NTLMv2 hash", and that ...
- 2,081
9
votes
2
answers
3k
views
Does Rainbow Table Not Require Decompression?
I understand that a rainbow table solves the storage problem when one attacks a password using precomputed hashes. However, since rainbow tables are essentially a compressed version of the hashes--...
- 1,576
6
votes
5
answers
5k
views
Why can salts be public? [duplicate]
From what I understand, salts are called "salts" rather than "keys" because they are allowed to be public. I understand that applying a random salt makes it difficult for rainbow table attacks because ...
- 253
2
votes
0
answers
416
views
The optimal settings of Winrtgen GUI
I'm working with Winrtgen GUI on windows, but I can't fix the right settings to create a rainbow table for a:
password length=1-7
Charset=alpha numeric all space
What are the ideal values to put in ...
- 21
3
votes
4
answers
539
views
Is knowing the salt a problem?
I understand that adding a salt would thwart the use of rainbow tables.
I don't understand the time it would take to create a rainbow table for a certain salt and of course this is dependent on the ...
- 243
6
votes
2
answers
2k
views
How do rainbow tables solve collisions?
I get the gist of it. It's like a middle ground between brute force attack and lookup table, it stores the starting plaintext and ending hash for each chain where a chain is made by reduction and hash....
- 409
4
votes
1
answer
3k
views
RSA rainbow table
Wouldn't it be possible to create as many as possible key pairs for the RSA encryption and then determine from a public key which the corresponding private key is ?
- 956
32
votes
12
answers
16k
views
Could I recover the content of file from its checksum/hash?
Let's say I have a video file that is split into multiple parts. Each piece is 2 Megabytes. I also have a list of the *insert hash name here* for each piece and also for the full file.
Now assume ...
- 565
4
votes
4
answers
415
views
Must an encrypted hash value be bigger than the password it was generated from?
I was reading a book called Introduction to network security theory and practice, and I found the following paragraph:
Rainbow Tables
A rainbow table is a table of two columns constructed as ...
- 143
4
votes
2
answers
1k
views
Why not slightly modify an existing hashfunction to create your own? [duplicate]
I read this interesting question on why improvising your own Hash function out of existing hash functions is bad. However this is specifically focusing on 'mixing' existing hashfunctions. What if for ...
- 343
3
votes
2
answers
872
views
Why can't a rainbow table attack identify and trash the salt?
Here's my understanding of a salted / hashed authentication scheme:
string plaintextPass = Request.Form["password"];
string salt = UserRecordFromDb.Salt;
string toHash = salt + plaintextPass;
string ...
0
votes
1
answer
228
views
Can you resalt hash/rainbow tables after finding the salt for something?
After a rainbow/hash table is salted, is it possible to resalt it after finding the correct salt instead of generating it all over again? If not, what is preventing you from doing so? How can you find ...
- 323
8
votes
1
answer
38k
views
Rainbow tables/hash tables versus WPA/WPA2
In Wi-Fi penetration testing, is it possible to use rainbow tables/hash tables on WPA/WPA2 networks?
Is there an advantage of one over the other?
...
- 323
11
votes
1
answer
8k
views
What is the difference between a hash table and a rainbow table, and how are they both used?
Is there much of a difference between the two tables? Can you get one from the other? (i.e. hash -> rainbow) How do they work? Are there different variables (in reference to speed, strength, resources,...
- 323
13
votes
1
answer
875
views
Naive implementation of Rainbow Table and/or Hellman's trade-off
This question is the same one I asked here. Since I haven't got any response or even a comment I will post it here as well.
Is there any naive implementation of Hellman's cryptanalytic time memory ...
0
votes
1
answer
5k
views
rainbow table for AES 256 CBC knowing IV, cipher text and plain text
I'm in a situation where I know that I have to decrypt a file encrypted using AES 256 CBC and I've the following details:
I know the first 16 bytes block in plain text
I know the IV (static 128 bit ...
- 153
1
vote
1
answer
2k
views
What does the SSID have to do with a networks security concerning rainbow tables?
I have noticed in a few places people mention that if a popular SSID is used, it makes a network more vulnerable to rainbow table attacks. I saw this in one location and assumed they'd mistakenly used ...
- 517
6
votes
1
answer
15k
views
WPA/WPA2 attacks
How does someone attack a WPA/WPA2 wireless network? I have read on the two main approaches: dictionary and rainbow tables. How do you use rainbow tables in conjunction with your tool of choice? I ...
- 61
1
vote
0
answers
569
views
Can't see advantages of rainbow tables over hash tables [closed]
I've read about rainbow tables (which I've confused with hash tables at first).
I understand that it uses a reduce function R(x) and by saving start value P(plaintext) and ending hashed value H I can '...
user56582
44
votes
6
answers
34k
views
Length of passwords that are rainbow table safe
With large computing power (like what you can get in the Amazon cloud for example) you can generate huge rainbow tables for passwords. There also seems to be some large rainbow tables reachable that ...
- 2,390
0
votes
2
answers
5k
views
Can NSA generate all hashes for rainbow table to break md5?
I was wondering about md5 encryption. It is good, and I agree that it is unbreakable.
But this is why we have rainbow tables.
What if bunch of people gather together and start brute forcing and ...
- 1,134
-4
votes
1
answer
683
views
How many possible symbols and punctuations in a password? [closed]
I want to compute the possible combinations of a password consists of 8 digits of: alphabetical letters (26), numbers (0-9), symbols and punctuations.
In order to compute this, I have to know the ...
- 315
258
votes
8
answers
79k
views
Why are salted hashes more secure for password storage?
I know there are many discussions on salted hashes, and I understand that the purpose is to make it impossible to build a rainbow table of all possible hashes (generally up to 7 characters).
My ...
user40448