Post #3944823

@thedarktangent@defcon.social Also not to rain on the parade or soapboz, but for completeness, I always try to be realistic with people about the practical limits of rainbow tables. Here's the section of the hashcat FAQ: https://hashcat.net/faq/rainbowtables Because of advances in GPU speeds, Rainbow tables have largely been displaced by GPU-based cracking solutions like hashcat in modern times, and are now only effective in a very narrow set of circumstances: The password hash algorithm is unsalted; You know how long the password is, and you know what character sets the password is made up of; The keyspace (total possible combinations) is small enough (the password is short enough - usually no more than 8 or 9 characters) - and the character set is small enough (usually not all 95 printable ASCII) to make it feasible to compute all possible hashes in advance and store them; You only have a few hashes to crack (because you can only crack a few at a time with rainbow tables); The password was randomly generated (instead of human-generated, for which much more efficient and productive GPU attacks are available); The hash is important enough that you need to crack it in a guaranteed shorter amount of time than the equivalent attack on GPU; All of the above is worth eating up terabytes of storage that's usually unused. In other words, the only remaining rainbow-table use cases - cases like “I am a pentester and I know for a fact that this company's Domain Admin account is 9 chars random upper and lower and numbers, and I need it before tomorrow” - are now extremely rare. And with the same amount of resources, millions of passwords can be cracked in the same amount of time, using GPUs and a reasonable amount of skill.