CEH Enumeration and System Hacking Practice Question
A penetration tester obtains a hash dump from a compromised Windows system and wants to crack LM and NTLM hashes quickly using precomputed tables. Which tool would be most efficient for this task?
⚠ Common exam trap
CEH often tests the distinction between tools that use precomputed tables (rainbow tables) versus those that use brute-force or dictionary attacks; candidates mistakenly choose Hashcat or John the Ripper because they are more well-known, but Ophcrack is the only option specifically optimized for LM/NTLM rainbow table cracking.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Ophcrack
Ophcrack is the most efficient tool for quickly cracking LM and NTLM hashes using precomputed tables because it is specifically designed to leverage rainbow tables (precomputed hash chains) for these hash types. It can crack LM hashes almost instantly and NTLM hashes with high success rates when paired with the correct rainbow tables, making it ideal for fast offline password recovery from a hash dump.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Hashcat
Why it's wrong here
Hashcat is a powerful and highly optimized password recovery tool renowned for its speed, primarily leveraging GPU acceleration for various attack types such as brute-force, dictionary, and rule-based attacks. While it supports numerous hash algorithms and can perform precomputation for certain attack vectors, Hashcat does not natively implement or utilize pre-generated rainbow tables for efficient lookup in the specialized manner that Ophcrack does for LM/NTLM hashes. Its strength lies in on-the-fly hash generation and comparison, not in rainbow table lookups.
- ✗
John the Ripper
Why it's wrong here
John the Ripper (JtR) is a versatile, open-source password cracker supporting a vast array of hash types and attack modes, including dictionary, brute-force, and single crack. Although JtR can process hash dumps and utilize custom wordlists or precomputed password lists, its core architecture is not specifically optimized for the rapid, indexed lookup of large pre-generated rainbow tables for LM/NTLM hashes. While it can crack these hashes through other methods, it lacks the specialized rainbow table lookup efficiency that Ophcrack provides.
- ✓
Ophcrack
Why this is correct
Ophcrack is a dedicated password cracker specifically designed to recover Windows LM and NTLM hashes by employing precomputed rainbow tables. This tool efficiently performs lookups within its extensive tables to reverse hashes back into their original plaintext passwords, making it exceptionally fast for common password sets. Its specialized focus on these hash types, combined with its user-friendly graphical interface, positions it as the optimal choice for this particular hash cracking method in a penetration testing scenario.
- ✗
RainbowCrack
Why it's wrong here
RainbowCrack is a foundational tool primarily focused on the generation and utilization of rainbow tables for various hash algorithms, offering significant flexibility in creating custom tables. However, for the specific task of cracking Windows LM/NTLM hashes from a dump, Ophcrack is generally preferred. Ophcrack typically comes with pre-packaged rainbow tables optimized for these Windows hash types and provides a more streamlined, user-friendly interface for the lookup process, making it more efficient and accessible for common penetration testing scenarios.
Go deeper
Related to this question
About these practice questions
This CEH question is part of Courseiva's 870-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.