From: Jerome Athias To: bugtraq-AT-securityfocus.comSubject: Free Rainbow Tables.comDate: Tue, 26 Sep 2006 22:29:27 +0200Archive-link: Article, Thread Hi there,we're proud to announce the official birth of website is dedicated to offer free rainbow tables (based on rainbowcrack)a complete set of MD5 tables alpha-numeric - lowercase - up to 8 characters is available for free downloadit's just the first project accomplished by various contributorsThe FreeRainbowTables Team had developped a (win32) distributed precomputation tool so if you have some CPUs available, you're invited to help us in bigger projects!Just contact the webmaster.Mirrors are welcome and spreading the tables in bitorrent-like networks also.Have a nice crack/JA (Log in to post comments) Free Rainbow Tables.com Posted Feb 9, 2018 12:30 UTC (Fri) by Rainbow-Tables (guest, #122487) [Link]
All Freerainbowtables.com MD5 Rainbow Tables
Now over 11TB are available online by Download or buying for free an hard driveHappy huntingFree Rainbow tables TeamHttp://www.rainbow-tables.com Free Rainbow Tables.com Posted Feb 11, 2018 12:47 UTC (Sun) by sdalley (subscriber, #18550) [Link]
Distributed Free Rainbow Tables (or DistrRTgen) was a volunteer computing project[3] for making rainbow tables for password cracking. By using the Berkeley Open Infrastructure for Network Computing (BOINC) software platform, DistrRTgen was able to generate rainbow tables that are able to crack long passwords. DistrRtgen was used to generate LM, NTLM, MD5 and MYSQLSHA1 rainbow tables.
This product is an internal SATA 3TB hard disk (manufacturer may vary) which has copies of a number of different rainbow tables and hash sets from various external sources and several generated by PassMark.
CrackStation uses massive pre-computed lookup tables to crack password hashes.These tables store a mapping between the hash of a password, and the correctpassword for that hash. The hash values are indexed so that it is possible toquickly search the database for a given hash. If the hash is present in thedatabase, the password can be recovered in a fraction of a second. This onlyworks for "unsalted" hashes. For information on password hashing systems thatare not vulnerable to pre-computed lookup tables, see our hashing security page.
Crackstation's lookup tables were created by extracting every word from theWikipedia databases and adding with every password list we could find. We alsoapplied intelligent word mangling (brute force hybrid) to our wordlists to makethem much more effective. For MD5 and SHA1 hashes, we have a 190GB,15-billion-entry lookup table, and for other hashes, we have a 19GB1.5-billion-entry lookup table.
But it is possible to attack the hashed value of your password using rainbow tables: enormous, pre-computed hash values for every possible combination of characters. An attacking PC could certainly calculate all these hashes on the fly, but taking advantage of a massive table of pre-computed hash values enables the attack to proceed several orders of magnitude faster-- assuming the attacking machine has enough RAM to store the entire table (or at least most of it) in memory. It's a classic time-memory tradeoff, exactly the sort of cheating shortcut you'd expect a black hat attacker to take.
It takes a long time to generate these massive rainbow tables, but once they're out there, every attacking computer can leverage those tables to make their attacks on hashed passwords that much more potent.
The smallest rainbow table available is the basic alphanumeric one, and even it is 388 megabytes. That's the default table you get with the Ophcrack bootable ISO. Even that small-ish table is remarkably effective. I used it to attack some passwords I set up in a Windows XP virtual machine with the following results:
You wouldn't expect this rainbow table to work on the passwords with non-alphanumeric characters (%&^$# and the like) because the table doesn't contain those characters. You'll also note that that passphrases, which I am a big fan of, are immune to this technique due to their length. But then again, this attack covered 99.9% of all possible 14 character alphanumeric passwords in 11 minutes, and that was with the smallest of the available rainbow tables. We could do better by using larger, more complete rainbow tables. The Ophcrack documentation describes the differences between the available rainbow tables it uses:
Note that all rainbow tables have specific lengths and character sets they work in. Passwords that are too long, or contain a character not in the table's character set, are completely immune to attack from that rainbow table.
Unfortunately, Windows servers are particularly vulnerable to rainbow table attack, due to unforgivably weak legacy Lan Manager hashes. I'm stunned that the legacy Lan Manager support "feature" is still enabled by default in Windows Server 2003. It's highly advisable that you disable Lan Manager hashes, particularly on Windows servers which happen to store domain credentials for every single user. It'd be an awful shame to inconvenience all your Windows 98 users, but I think the increase in security is worth it.
The Ophcrack tool isn't very flexible. It doesn't allow you to generate your own rainbow tables. For that, you'll need to use the Project Rainbow Crack tools, which can be used to attack almost any character set and any hashing algorithm. But beware. There's a reason rainbow table attacks have only emerged recently, as the price of 2 to 4 gigabytes of memory in a desktop machine have approached realistic levels. When I said massive, I meant it. Here are some generated rainbow table sizes for the more secure NT hash:
A rainbow table attack is usually overkill for a desktop machine. If hackers have physical access to the machine, security is irrelevant. That's rule number 3 in the 10 Immutable Laws of Computer Security. There are any number of tools that can reset passwords given physical access to the machine.
But when a remote hacker obtains a large list of hashed passwords from a server or database, we're in trouble. There's significant risk from a rainbow table attack. That's why you should never rely on hashes alone-- always add some salt to your hash so the resulting hash values are unique. Salting a hash sounds complicated (and vaguely delicious), but it's quite simple. You prefix a unique value to the password before hashing it:
If you've salted your password hashes, an attacker can't use a rainbow table attack against you-- the hash results from "password" and "deliciously-salty-password" won't match. Unless your hacker somehow knows that all your hashes are "delicously-salty-" ones. Even then, he or she would have to generate a custom rainbow table specifically for you.
If you're looking for decryption, you can create (or get) rainbow tables - essentially, create a password generator that encrypts with MD5 and invent as many hashes as you want. Save the hashes to a database. From there, do a search for your hash.
You may be interested in freerainbowtables.com. This site contains a list of "rainbow tables". Similarly, if you have entered a key into a cracking website there is every probability it has added it to its tables.
This is actually the same as Half LM Challenge, only differences are it's slower and it won't tell you if you crack the first 7 characters.Instead generate Half LM Challenge and Second Half LM Challenge tables. Second Half LM Challenge tables would look like this in RT* format:2ndhalflmchall_hybird2(byte#1-1,alpha#1-7)#0-0_*.rt*
P.S. If you have LM Challenge tables just rename them from lmchall_* to halflmchall_* and you'll get a speed increase.Only problem comes in if the table has a password longer than 7 characters because some implementations will buffer overflow like rcracki_mt:
RainbowCrack is a password cracking tool designed to work using rainbow tables. It is possible to generate custom rainbow tables or take advantage of preexisting ones downloaded from the internet. RainbowCrack offers free downloads of rainbow tables for the LANMAN, NTLM, MD5 and SHA1 password systems.
OphCrack is a free rainbow table-based password cracking tool for Windows. It is the most popular Windows password cracking tool but can also be used on Linux and Mac systems. It cracks LM and NTLM hashes. For cracking Windows XP, Vista and Windows 7, free rainbow tables are also available.
Be warned though, Rainbow tables can be defeated by salted hashes, if the hashes are not salted however and you have the correct table, a complex password can be cracked in a few minutes rather than a few weeks or months with traditional brute forcing techniques.
There are various locations you can download Rainbow Tablse, for example you can find a fairly comprehensive set of free Rainbow Tables at Project RainbowCrack including paid tables optimized for various things (LM, NTLM, MD5, SHA1 etc).
Las rainbow tables (tablas arcoíris) son las más potentes para cracking de hash. Explicar la lógica de creación y uso de estas para crackear una contraseña es difícil, por lo tanto te propongo explicártelo en tres pasos.
Primero voy a explicar cómo se crea y se usa una tabla sencilla de consulta de hash, luego voy a explicar cómo se crea una tabla rainbow (aunque no entiendas para que lo estoy haciendo) y por último te voy a explicar exactamente por que acorta el tiempo encontrando la contraseña en texto plano. 2ff7e9595c
Comments