Welcome to part seven of this module rainbow tables.
I've mentioned them in passing and now it's time to talk about them.
In this video we'll be taking a look at Rainbow crack on Kelly Linux which is found under applications.
Password attacks.
Fair warning.
This video is going to be heavy on the explanation and a bit light on demonstration.
If you stick with it you'll understand why.
First off in order to make sure each of these videos is stand alone for those wishing to reference a
particular tool or concept I will briefly explain that a password hash is basically a string of characters
that were you to decode them would give you plain text information.
This is usually a password but could be a credit card number or name or some other very important piece
of information.
There are several different hashing algorithms so a password that is converted to empty five will have
a hash that looks quite different from the exact same password converted into let's say A.L. M.
For example the word password an empty five looks like this.
That is an empty five hash in the previous videos in this module.
You've seen examples of how to brute force hashes as well as perform dictionary based attacks against
them all of these methods involve throwing words or combination of words and characters at the hash
by converting them into a hash and trying to match up the characters with those of the hash trying to
crack.
It's very time consuming particularly as each guest's requires a conversion to take place which adds
on the time the process takes exponentially.
So the question I would like you to ask yourself as you're thinking about this is what if you already
had a file that contained all possible hashes.
What if the dictionary file you are using for your dictionary based attack and every word in it already
pre converted into a hash of the appropriate format.
What if you could even add in a particular salt or you had all the possible character set combinations
already converted into hashes and stored in a table now before we begin I have to be honest.
Although rainbow tables are a big part of penetration testing and hacking I have not used them very
much.
The reason for this has to do with hardware.
As you'll soon come to understand it is a big limitation.
The idea behind rainbow crack is that it uses time memory tradeoff algorithms to crack hashes it differs
from brute force.
Hash crackers in the sense that a brute force cracker will generate all possible plaintext and compute
the corresponding hashes on the fly.
Then it will compare against the hash to be cracked.
Once a match is found the plain text is found.
If all possible plain texts are tested and no match is found then you're out of luck.
The plain text is not found.
It's really all or nothing with this type of hash cracking all intermediate computation results are
discarded.
A time memory tradeoff hash cracker on the other hand needs a pre computation state at the time all
plain text hash pairs within the selected hash algorithm character set plain text length are computed
and results are stored in files which are called rainbow tables.
It's time consuming to do this kind of computation but once the time pre computation is finished hashes
stored in the table can be cracked with much better performance than a brute force cracker graphics
card acceleration is another key feature of rainbow crack by offloading most of the runtime computations
to in video or M.D. GP use.
Overall cracking performance can be improved even further.
Great.
So show me the tool already I hear you say.
Well I did say this was going to be theory heavy.
Here's why I pulled up Project Rainbow.
Crack dot com.
And if we scroll down a little bit.
Here's some rainbow tables if you'd like to download them.
Notice that each category has its own set of tables MDG 5 mix alphanumeric is not the same as SHA 1.
Mix alphanumeric.
Notice also that the smallest of these tables weighs in at just over 50 gigabytes and larger examples
go as high as 690 to 864 gigabytes and they can get even bigger than that but I'm not trying to scare
you off.
This is where the rainbow cracked tool comes in but I want you to keep in mind that a full sized quote
unquote perfect table for a particular character set under a particular format is going to be positively
gargantuan.
If you happen to have a computer with a legendary amount of hard disk space ideally solid state more
RAM then you know what to do with a super high end graphics card or two or four or six and a really
good cooling system then you can setup one heck of a cracking station if you use all of these tables.
But before we leave this page which is again project dash rainbow crack dot com by the way I want to
point out that should you wish to use rainbow crack to generate any of these lists you see here from
scratch the commands to do so or at the bottom of the page don't click on one of these let's just click
on empty five ASCII what I have highlighted here is just the syntax for one part of this particular
table
you would run all of these commands one after another using the rainbow crack tool to generate this
one table as you can see setting this up is a big deal you need a powerful system to get the most out
of it a can and will run rainbow crack to generate a much smaller table to show off how this process
works but the point I'm trying to make is if you have the hardware rainbow tables are really the way
to go this will invoke the full power of that hardware and greatly improve your capability but on an
old laptop or dare I say virtual box this method is of questionable usefulness a smaller table might
work for you and indeed a very old application called off crack does in fact use smaller tables to crack
passwords for Windows systems that are older than Windows 7 I didn't do a video on this program because
it's so badly out of date that it's basically not functional anymore and there are better ways to crack
such passwords but the point is it's a small table can still be useful in some cases
the last thing I want to point out before I generate a small table
there are links to three video demonstrations of rainbow tables being used to crack three different
hashes these videos are offered by Project Rainbow crack itself since this sort of demonstration is
beyond the hardware capability of people like me but there isn't really that much to see a simple gooey
in a Windows environment a single hash and a whole lot of tables.
The program attacks the hash using the tables and that's basically it
our crack empty is by the way the command line method of doing what you will see in those videos but
this is assuming you have the appropriate tables to actually use if you are using a tiny one like I'm
going to you're probably just better off using one of the other methods shown in this module because
you weren't going to get a lot of bang for your buck in terms of the memory time tradeoff.
So without further ado let's go ahead and generate a small table just for demonstration purposes.
We'll use Archie Chen to get the syntax OK Artie gen and we're going to specify for this example we'll
do SHA 256 and we're going to do lower alpha numeric and 1 5 0.
We're going to limit it to a maximum of five characters long with a minimum of 1 tables 0 and we'll
say a limit of 1000 minimum 1000 maximum
leave.
We need to zero as well because it's not part of an index and we'll press Enter OK so this will now
generate the rainbow table.
This may take some time and this might make more sense if I was trying to crack a database file filled
with hashes that I knew for a fact were one to five character strings long and maybe just numbers and
if I knew they were SHA 256.
In this very specific example using this method might be faster than just brute forcing it in the traditional
way.
It makes more sense if you pretend that I'm not recording this video in a virtual box environment.
When Kelly is installed to a dedicated partition with full system resources at its command and a decent
GP you this approach becomes a lot more tenable OK.
It looks like it has generated it's quite small at 1000 rainbow chains.
So let's go ahead and pull it up believe it stored in seedy user share rainbow crack
Yes and there it is.
So the table was created.
We could then use this table in any program that calls for it.
You can experiment with your character sets and your range.
You can create really as many rainbow tables as you like but realistically in my personal opinion this
is an all or nothing type of a thing.
If you have all possible rainbow tables for your target or at least for the type of hash you're trying
to crack and you've got the hardware you can generate all of the tables you saw on the web page using
the command shown and you can go to town but if you're using smaller tables that weren't created for
cracking specific things over and over again such as a database with you know a five digit pin number
over and over again different hashes all five digit PIN numbers and you know that they're going to be
numbers and you know they're all like empty five or something.
You're probably just better off using brute force or a word list.
Your odds aren't really any better using a rainbow table which is going to take a very long time to
create which would then offset the amount of time that it saves you.
These tables are for people with really good hardware and a reason to break hashes on a regular basis.
It's not a great fit for small time pen testers with ordinary laptops and you absolutely do not need
to use rainbow tables to crack hashes but if you can use them and if you've got a computer that's up
to the challenge they will definitely speed up the process as always.
Never use this tool or any other tool shown in this class against any target that you don't either personally
own referee written permission from the owner to penetration test.
I hope he found this explanation helpful.
I'm sorry it was probably very boring without much to look at but this is material that had to be covered.
Rainbow tables are useful tools.
They really are.
It's just that you have to be in the right situation for them to really come into their own.
So I hope you found this tutorial helpful I'm sorry that it was a little on the short side.
Thank you for your patience and your attention.