Passwords are typically stored in files or databases to prevent unauthorized access. Storing them in clear-text would make it easy for attackers to steal them. Since gaining control over credentials means gaining full control over an account and its privileges, passwords must be stored in encrypted form to prevent unauthorized access by malicious users.
To make things even harder for attackers, passwords are stored by using a one-way encryption algorithm ;there is no way to know the password starting from its encrypted form. Cryptographic ‣ hashing functions are used to transform a password from its clear-text form to an encrypted and safe to store form.
Password cracking ⇒ is the process of recovering clear-text passwords starting from their hash ‣ hash [<https://crackstation.net/>](<https://crackstation.net/>)
To automate such processes, there are two main strategies:
Brute Force Attacks vs. Dictionary Attacks
Brute force attacks and dictionary attacks are both methods used by attackers to gain unauthorized access to computer systems or online accounts. However, there are some key differences between the two:
Method ⇒ In a brute force attack, the attacker tries every possible combination of characters as the password for a target account. In a dictionary attack, the attacker tries every word in a dictionary or a list of commonly-used passwords as the password for a target account.
Speed ⇒ ****Brute force attacks can take much longer to complete than dictionary attacks, as the attacker must try every possible combination of characters. Dictionary attacks, on the other hand, are much faster, as the attacker only needs to try a limited number of words.
Rainbow Tables Attack
Rainbow table attack is a type of brute force password-cracking technique that uses pre-computed tables to hack passwords. Instead of relying on slow brute-force methods of trying out passwords, attackers use such tables to crack passwords. A rainbow table is a large database of hash outputs for all input values. An attacker does not need to guess or try out passwords to convert them to hash output. He simply matches the hash of the stolen password with entries on his rainbow table to get the original (cracked) password. The reason this attack is so dangerous is that it allows attackers or crackers to hide the time to crack passwords.
A great tool to perform rainbow cracking is **ophcrack**.
On its site, you will also find some free rainbow tables, where its size ranges can be from 300MB to 2TB Website ophcrack