2 cissp ® Official Study Guide Eighth Edition

Rainbow Table Attacks 
It takes a long time to fi nd a password by guessing it, hashing it, and then comparing it 
with a valid password hash. However, a
rainbow table
reduces this time by using large 
databases of precomputed hashes. Attackers guess a password (with either a dictionary or 
a brute-force method), hash it, and then put both the guessed password and the hash of the 
guessed password into the rainbow table. 
A password cracker can then compare every hash in the rainbow table against the hash 
in a stolen password database fi le. A traditional password-cracking tool must guess the 
password and hash it before it can compare the hashes, which takes time. However, when 
using the rainbow table, the password cracker doesn’t spend any time guessing and calcu-
lating hashes. It simply compares the hashes until it fi nds a match. This can signifi cantly 
reduce the time it takes to crack a password. 
Many different rainbow tables are available for free download, but they 
are large. For example, an MD5-based rainbow table using all four char-
acter types for an eight-character password is about 460 gigabytes in 
size. Instead of downloading these tables, many attackers create their 
own using tools such as rtgen (available in Kali Linux) and scripts freely 
available on the internet.
Many systems commonly
salt
passwords to reduce the effectiveness of rainbow 
table attacks. A salt is a group of random bits added to a password before hashing it. 
Cryptographic methods add the additional bits before hashing it, making it signifi cantly 
more diffi cult for an attacker to use rainbow tables against the passwords.
Bcrypt
and 
Password-Based Key Derivation Function 2 (PBKDF2)
are two commonly used algorithms 
to salt passwords. 

---

Understanding Access Control Attacks 
647
However, given enough time, attackers can still crack salted passwords using a brute-
force attack. Adding a pepper to a salted password increases the security, making it more 
difficult to crack. Salts are random numbers stored in the same database holding the hashed 
passwords, so if an attacker gets the database, the attacker also has the salts for the pass-
words. A 
pepper
is a large constant number stored elsewhere, such as a configuration value 
on a server or a constant stored within application code.
While the practice of salting passwords was specifically introduced to thwart rainbow 
table attacks, it also thwarts the effectiveness of offline dictionary and brute-force attacks. 
These offline attacks must calculate the hash of the guessed passwords, and if the stored 
passwords include salts, the attacks fail unless they also discover the salt. Again, the use 
of a pepper stored outside the database holding the salted, hashed passwords makes all of 
these attacks even more difficult.