Lesson 5 of 6

Rainbow Table Attacks

Rainbow tables are precomputed lookup tables that trade storage space for cracking speed, allowing attackers to instantly reverse unsalted hashes. You will learn how rainbow tables work, why they were once the dominant password cracking technique, and how password salting completely defeats them. Understanding rainbow tables explains why salting is a non-negotiable requirement in modern password storage.

Learning Objectives — Deep Dive

Each objective below is broken down into plain English so you know exactly what you are learning, why it matters, and what you will be able to do when you are done. Mark each one complete as you work through the lesson.

0/4

In plain English

This is asking you to build a clear mental model of the concept — not just memorize a definition, but genuinely understand what it means, why it exists, and how it connects to everything else you are learning. When you can explain "how rainbow tables work" in your own words to someone who has never heard of it, you have truly learned it.

Why this matters

This objective builds a foundational skill that every security professional uses regularly. Mastering it gives you the vocabulary, mental models, and practical ability to tackle more advanced topics with confidence — and to communicate clearly with both technical and non-technical colleagues.

Real-world analogy

Think of it like learning to drive. You do not need to understand how the engine works to drive safely, but knowing the basics helps you diagnose problems and avoid mistakes that could cause accidents. The same principle applies here — foundational knowledge prevents costly errors.

What you will be able to do

Apply this skill in a real lab environment, explain it clearly to a colleague or client, and use it as a building block for the more advanced techniques that come later in this course.

Beginner tip

Do not try to memorize everything at once. Read through the material once to get the big picture, then go back and work through the lab. The hands-on practice is what makes the concepts stick — passive reading alone will not get you there.

Rainbow Table Attacks · Objective 1 of 4

VIDEO

Loading video…

Generate an unsalted MD5 hash

Run 'echo -n "password" | md5sum' to generate the MD5 hash of the word 'password' — you should get '5f4dcc3b5aa765d61d8327deb882cf99'. This exact hash appears in every rainbow table and online hash lookup database because it is one of the most commonly used passwords. Run 'echo -n "123456" | md5sum' and 'echo -n "qwerty" | md5sum' and note those hashes as well. The key insight is that without a salt, every user who chooses the same password will have the identical hash — an attacker who cracks one hash has cracked all accounts using that password simultaneously.

Look it up online

Navigate to crackstation.net and paste the MD5 hash of 'password' (5f4dcc3b5aa765d61d8327deb882cf99) into the search field. CrackStation will instantly return the plaintext 'password' because it maintains a massive precomputed lookup table of common password hashes. Try the hashes for '123456', 'qwerty', and 'letmein' — all will be found instantly. This demonstrates why unsalted hashes of common passwords provide essentially zero security — the lookup is faster than the time it takes to type the hash. Also try hashes.com and md5decrypt.net to see multiple lookup services returning the same results.

Generate a salted hash

Run 'python3 -c "import hashlib, os; salt = os.urandom(16).hex(); h = hashlib.sha256((salt + 'password').encode()).hexdigest(); print(f'Salt: {salt}\nHash: {h}')"' to generate a salted SHA-256 hash. Run the command three times and observe that each run produces a completely different hash even though the password is the same — the random salt makes each hash unique. Paste the salted hash into CrackStation and confirm it returns 'Not found' — the precomputed lookup tables are useless against salted hashes because the salt must be known to compute the correct hash. The salt does not need to be secret; it is typically stored alongside the hash in the database.

Understand the defense

The correct defense against password cracking is to use a purpose-built password hashing function: bcrypt, scrypt, or Argon2 (the winner of the Password Hashing Competition). These functions are intentionally slow and memory-intensive, automatically handle salting, and include a configurable cost factor that can be increased as hardware gets faster. Never use MD5, SHA-1, or SHA-256 directly for password storage — they are designed to be fast, which is exactly the wrong property for a password hash. In code, use your language's built-in library: Python's 'passlib', Node.js's 'bcryptjs', PHP's 'password_hash()', or Java's Spring Security's 'BCryptPasswordEncoder'.

Previous: Brute Force Techniques Next Lesson