CEH Enumeration and System Hacking Practice Question
Which of the following tools is specifically designed to crack Windows LAN Manager (LM) and NTLM hashes using rainbow tables?
⚠ Common exam trap
It's easy for candidates to confuse RainbowCrack (a generic rainbow table tool) with Ophcrack (which is specifically designed for Windows LM/NTLM hashes), leading them to select RainbowCrack despite Ophcrack being the correct answer due to its Windows-specific focus.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Ophcrack
Ophcrack is specifically designed to crack Windows LM and NTLM hashes using precomputed rainbow tables. It leverages the time-memory trade-off technique to rapidly reverse these hashes without brute-forcing, making it the correct choice for this targeted task.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Hashcat
Why it's wrong here
Hashcat is a powerful, GPU-accelerated password recovery tool known for its speed and support for numerous hashing algorithms and attack modes (brute-force, dictionary, hybrid, mask). While it can process hashes that might originate from rainbow table lookups or even generate hashes for comparison against precomputed tables, it is not specifically designed to create or utilize rainbow tables as its core methodology for cracking Windows LM/NTLM hashes. Its strength lies in its diverse cracking capabilities rather than a singular focus on rainbow tables.
- ✗
RainbowCrack
Why it's wrong here
RainbowCrack is a specialized tool primarily designed for generating and using rainbow tables to crack cryptographic hashes. It excels at precomputing tables for various hash types, allowing for rapid lookup and password recovery. However, while it can certainly be used with LM and NTLM hashes, it is a more general-purpose rainbow table utility and does not come pre-packaged or specifically optimized with the precomputed tables for Windows hashes, nor the user-friendly interface that Ophcrack offers for that specific task.
- ✗
John the Ripper
Why it's wrong here
John the Ripper (JtR) is a widely used, open-source password cracking tool known for its robust dictionary and brute-force attack capabilities across many operating systems and hash types. It supports numerous hash formats, including LM and NTLM, and can perform various attack modes. However, JtR's primary design does not revolve around the generation or direct utilization of precomputed rainbow tables as its core cracking mechanism, especially not with a specific focus on Windows hashes in that manner, unlike tools explicitly built for rainbow table lookups.
- ✓
Ophcrack
Why this is correct
Ophcrack is a dedicated and highly effective password cracker specifically designed to recover Windows LM and NTLM hashes by leveraging precomputed rainbow tables. It comes with pre-generated tables optimized for these hash types, allowing for very fast lookups and password recovery, even from live systems or SAM files. Its primary strength lies in its specialized focus and efficient implementation of rainbow table technology for Windows authentication credentials.
Go deeper
Related to this question
About these practice questions
One of 870 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.