Hash & Rainbow Table

What is Hashing?

Hashing is simply passing some data through a formula that produces a result, called a hash. That hash is usually a string of characters and the hashes generated by a formula are always the same length, regardless of how much data you feed into it. For example, the MD5 formula always produces 32 character-long hashes. Regardless of whether you feed in the entire text of MOBY DICK or just the letter C, you’ll always get 32 characters back.

Finally each time you run that data through the formula, you get the exact same hash out of it. So, for example, the MD5 formula for the string "STENGE.info" returns the value b7f74d09c607413d22f318dc2c168da5. Every time it will return that same value.

Changing even one character or upper/lower case will produce an entirely different result. For example the MD5 for "stenge.info" will be 000b7d91b8e5b8dd50153427996943bf.

Can I Break a Hash?

One of the easiest ways is to access a list of words and the hash that each results in. For example, there are websites that publish millions of words and their related hash values. Anyone can go to these sites, search for a hash value and instantly find what the value was before it was hashed.

password123	482c811da5d5b4bc6d497ffa98491e38
​qazwsx	76419c58730d9f35de7ac538c2fd6737
letmein	0d107d09f5bbe40cade3de5c71e9e9b7

To protect against this, security professionals use a technique known as salting. To salt a hash, simply append a known value to the string before you hash it. For example, if before it’s stored in a database every password is salted with the string ‘dog’, it will likely not be found in online databases. So, password salted with dog (i.e. passworddog) and then run through the md5 calculator becomes 854007583be4c246efc2ee58bf3060e6.

What is a Rainbow Table?

The passwords are not stored directly as plain texts but are hashed using encryption. A hash function is a 1-way function, which means that it can’t be decrypted. Whenever a user enters a password, it is converted into a hash value and is compared with the already stored hash value. If the values match, the user is authenticated.

A rainbow table is a database that is used to gain authentication by cracking the password hash. It is a precomputed dictionary of plaintext passwords and their corresponding hash values that can be used to find out what plaintext password produces a particular hash. Since more than one text can produce the same hash, it’s not important to know what the original password really was, as long as it produces the same hash.

How does the Rainbow Table Attack work?

A rainbow table works by doing a cryptanalysis very quickly and effectively. Unlike bruteforce attack, which works by calculating the hash function of every string present with them, calculating their hash value and then compare it with the one in the computer, at every step. A rainbow table attack eliminates this need by already computing hashes of the large set of available strings.

Disadvantage:

▸ A large amount of storage is required for store tables.

👽⚠️ 𝗧𝗵𝗶𝘀 𝗶𝘀 𝗷𝘂𝘀𝘁 𝗳𝗼𝗿 𝗲𝗱𝘂𝗰𝗮𝘁𝗶𝗼𝗻𝗮𝗹 𝗽𝘂𝗿𝗽𝗼𝘀𝗲𝘀 ⚠️👽

Just to know! Check this website below:

https://freerainbowtables.com/