Hey everybody welcome to the next video.
We're going to be talking about rainbow tables.
Now what a rainbow tables a rainbow table is a large database of password hashes and their plain text
counterpart.
Now this type of database can be hundreds of gigs thousands of gigs it entirely depends on the type
of rainbow table that you want people generate then just in their own spare time and with thousands
of people generating rainbow tables eventually you're going to get a good list going are a good database
going.
The main reason for this is because it reduces the memory requirement to attack or cracking a password.
And normal situations a such as traditional brute forcing which took over and second it is very memory
intensive.
But this compromises memory requirements for larger disk space and time so it takes a little bit longer
for it to go through everything but it doesn't have as much of a memory requirement.
Now just a recap of traditional brute forcing is every letter digit symbol in any order has to be rehashed
every time the string is changed.
This can be very very memory intensive very intensive G.P. you intensive.
It's a very long process and it's very slow and hard to crack anything past five to six maybe seven
characters depending on how long you have to wait and how many how much power your machine has.
So this is why it comes into play because it's very it's very nice to have pre-built hashes ready for
you.
So you can just do your searching based on the pre-built hashes instead of trying to figure it out by
scratch by rehashing every possible combination in the world
now rainbow tables rainbow tables use a step called reduction to create chains of hashes and these chains
are also known as tables and each chain will be looked at until the plain text is found so it'll go
through the first chain then the second chain the third chain.
Now how reduction works.
So essentially how a table or a chain is built.
So if we start off with initial empty five hash right.
So let's just grab just use this random empty five hash.
So this is our hash that we want to start generating our chain from.
Now we're talking about this in the terms of generation and not in trying to find the plain text of
a password this is how a chain is generated.
So we start off with some handy five hash or any type of hash.
And also the we know what the plain text of that hash is.
So then we hit the first chain and grab the first eight characters and rehash it so you can see this
first eight.
Right here is then Regan through an empty five hash and then we get a new hash and then this process
will grab the next eight character first eight characters then repeat the Hash again.
And this process will continue until the user decides that they don't want to generate anymore hashes.
And then once that's done a chain or the table is now complete.
So you can understand now how a chain or a table is built.
And then next we're going to go into the process flow of a rainbow tabletop so the first thing we do
is we have our hash submitted.
Right.
We submit this to the rainbow tables through some application that utilizes the rainbow tables.
Then we check the hash against the final hash and each chain.
And if there's a match we're going to go ahead and go up here and if there's not we're going to reduce
the hash to it's plain text which is not the plain text of the original password but the plain text
as far as the rainbow tables is concerned of that hash and then it rehashes that plain text and goes
ahead and repeats that process essentially.
This is a reduction process that occurs on the initial hash sort of creating its own chain until one
of those hashes have are found in the database and once a find in the database they're going to grab
the next part of the chain hash to plain text again and then see if it matches the original hash that
we started with.
If it doesn't we're going to go ahead and re redo the reduction process again and then rinse and repeat
that process if it does match then we know what our plain text is and we can go ahead and look up that
hash that we found with the plain text that we have in the database and we in turn get our plaintext
on the password hash that we submitted.
So it's it's quite a complicated process and take some time to study the flowchart re watch the video
a few times.
It's important to understand what's going on here because in the hands on I'm going to I'm going to
task you guys with going ahead and downloading a rainbows table and actually going through and taking
a password hash of MDT 5 with the empty five password hash of password as an example.
I'm going to give you guys an empty five hash and what I want you to do is go through and build your
own build out the rainbow tables set up you can use a pre-built rainbow table if you want to and try
to grab the plain text of the hash I provide you guys.