CEH Enumeration and System Hacking Practice Question
A penetration tester wants to crack Windows NTLM hashes using rainbow tables. Which tool is specifically designed for this purpose?
⚠ Common exam trap
In the CEH exam, candidates often confuse Ophcrack (which is also a rainbow table tool but limited to LM/NTLM on older Windows) with RainbowCrack (the general-purpose tool), or they assume Hashcat or John the Ripper are the primary tools for rainbow table attacks when they are not specifically designed for that purpose.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
RainbowCrack
RainbowCrack is specifically designed for cracking hashes using precomputed rainbow tables. It works by performing a lookup in a rainbow table to reverse a hash into its plaintext, which is the core mechanism described in the question. While Hashcat and John the Ripper can also crack NTLM hashes, they are not specifically designed for rainbow table attacks; they primarily use brute-force or dictionary-based methods.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Hashcat
Why it's wrong here
Hashcat is a highly optimized, GPU-accelerated password recovery tool primarily designed for dictionary, brute-force, hybrid, and rule-based attacks. While it can process various hash types, its core architecture focuses on generating candidate passwords and hashing them on the fly for comparison, rather than directly utilizing the specific precomputed rainbow table format employed by tools like RainbowCrack. Therefore, it is not the ideal choice for directly leveraging existing rainbow tables for NTLM hash cracking.
- ✗
John the Ripper
Why it's wrong here
John the Ripper (JtR) is a powerful and versatile password cracker renowned for its extensive dictionary attacks, brute-force capabilities, and customizable rulesets. It excels at generating and testing candidate passwords against target hashes in real-time. However, JtR's design does not natively incorporate the direct application of precomputed rainbow tables as its primary cracking mechanism, making it less suitable when the specific requirement is to crack NTLM hashes *using* such tables.
- ✓
RainbowCrack
Why this is correct
RainbowCrack is a specialized tool explicitly designed to utilize precomputed rainbow tables for efficient password recovery. It leverages the space-time trade-off inherent in rainbow table methodology, where extensive precomputation allows for exceptionally fast lookup during the cracking phase. By using these tables, RainbowCrack can quickly reverse NTLM hashes into their original plaintexts, provided the plaintext exists within the table's precomputed range, making it the most direct and effective tool for this specific task.
- ✗
Ophcrack
Why it's wrong here
Ophcrack is a dedicated Windows password cracker that relies on precomputed rainbow tables, often bundled with its own set of tables optimized for common Windows password formats. While it does use rainbow tables, its primary focus is on cracking local Windows SAM file hashes and it is less flexible for general NTLM hashes obtained from arbitrary sources or for generating custom rainbow tables. Its specialized nature makes it less suitable for the broader task of cracking general NTLM hashes using rainbow tables compared to a more versatile tool like RainbowCrack.
Go deeper
Related to this question
About these practice questions
This CEH question is part of Courseiva's 870-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.