Now you've already heard me say the term rainbow table so I'd like to formally introduce
rainbow table. A rainbow table is a it's very similar to a word list except this list contains
possible combinations of passwords to their hash or encryption method like DES.
So let's say we have a password of password and we compile how password would look in
those different hash forms. So there could be up to 30 50 different variants of password and
we would have that inside of our rainbow table to be able to go through and try those different
methodologies based on the type of system that we're attacking. So it's taking all different
forms of the different types of passwords attacks and compiling them into a list for us to be able
to try that's already pre-compiled and pre-configured with a different hashing algorithms.
Now what we have on the screen here and I'll have a link for this below is off crack and this is one
of the tools that we have inside of Kali to actually use rainbow tables with in order to
crack windows passwords. And this site right here has different types of rainbow tables that will
be installed in the lab. Some of them will be because as you can see let me zoom in for you
right here all free XP tables is 17 gigs. The size of a rainbow table can increase depending on the
requirements that you have for the types of hashing and encryption methods for each individual
password that you have inside of your list. So as you can see some of these have like XP free small
has a character set of zero through nine all lowercase and all uppercase. So it's going to try
all the permutations of a password based on the different algorithms that XP has for password
cracking so or for password hashing I should say. So the word password would be hashed ntlm this way
and then in the rainbow table it's going to try that based on its computation of the word password
inside of off crack the tool which we will get into. Just know that rainbow tables take up a
large amount of size and they cause suspicion when you start searching for them on the internet
because it's not something that people look for all the time. And I can tell you from DOD experience
that somebody that starts research of rainbow tables a good bit should be in the field of
pin testing and be here with us at CVT Nuggets for example because this is the kind of thing
that gets you looked at a little bit funny when you're in the
cyber security circles talking about rainbow tables.