CEH Enumeration and System Hacking Practice Question

A security team has collected a hash file from a compromised Windows server that contains NTLM hashes. They want to crack the passwords as quickly as possible using a precomputed lookup table. Which tool and technique combination is BEST suited for this task?

⚠ Common exam trap

EC-Council often tests the distinction between offline hash cracking (RainbowCrack, Hashcat, John) and online brute-forcing (Hydra), and the trap here is that candidates confuse Hydra's online attack capability with offline hash cracking, or assume Hashcat's rules-based attack is faster than a precomputed lookup table.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Use RainbowCrack with precomputed rainbow tables

RainbowCrack is specifically designed for fast password cracking using precomputed rainbow tables, which are lookup tables that store hash chains for rapid reversal of hashes. Since the team already has NTLM hashes and wants the quickest method, RainbowCrack with precomputed tables avoids the computational overhead of real-time hashing, making it the best fit for this scenario.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Use John the Ripper in incremental mode
Why it's wrong here
John the Ripper's incremental mode performs a pure brute-force attack, systematically trying every possible character combination within a defined charset and length. While effective for very short or simple passwords, this method is computationally extremely intensive and inherently slow for longer or more complex hashes. It lacks the efficiency of precomputed methods like rainbow tables, which avoid redundant calculations through a time-memory trade-off.
✗
Use Hydra with a dictionary of common passwords
Why it's wrong here
Hydra performs online brute-force attacks against live authentication services, not offline hash cracking against a static NTLM hash file; the scenario requires a precomputed lookup table such as a rainbow table, which Hydra cannot use. It is tempting because Hydra is a fast password-guessing tool for network services, and would be correct if the team needed to test live login credentials against a remote server rather than crack captured hashes locally.
✓
Use RainbowCrack with precomputed rainbow tables
Why this is correct
RainbowCrack is specifically engineered to utilize precomputed rainbow tables for rapid offline hash cracking. This technique capitalizes on a significant time-memory trade-off, where extensive upfront computation generates large tables that allow for near-instantaneous reversal of hashes back to their plaintext passwords. This makes it an exceptionally efficient method for processing large volumes of captured hashes, often yielding results in mere seconds.
✗
Use Hashcat with a rules-based attack
Why it's wrong here
A rules-based attack with Hashcat enhances dictionary attacks by applying predefined transformation rules (e.g., appending numbers, case changes, character substitutions) to dictionary words. While powerful for guessing common password patterns and variations, this method still involves generating and hashing candidate passwords on the fly. For cracking a static hash file, precomputed rainbow tables offer a fundamentally faster lookup mechanism compared to the iterative process of a rules-based attack, even with Hashcat's optimization.

Go deeper

CEH Enumeration and System Hacking Practice Question

Why each option matters

Option-by-option breakdown

Related to this question