CEH Enumeration and System Hacking Practice Question
Which tool is specifically designed to crack Windows LM and NTLM hashes using precomputed tables?
⚠ Common exam trap
Candidates often confuse 'precomputed tables' with general cracking tools like Hashcat or John the Ripper, which can also use precomputed tables in some configurations, but Ophcrack is the only tool specifically designed and optimized for that purpose with Windows LM/NTLM hashes.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Ophcrack
Ophcrack is specifically designed to crack Windows LM and NTLM hashes using precomputed rainbow tables. It relies on the time-memory trade-off technique, where hashes are looked up in precomputed tables rather than computed on the fly, making it highly efficient for these specific hash types. The tool is bundled with free rainbow tables for LM hashes and supports NTLM through additional table sets.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Ophcrack
Why this is correct
Ophcrack is purpose-built for cracking Windows LM and NTLM hashes, leveraging precomputed rainbow tables for highly efficient password recovery. Its specialization allows it to quickly reverse these specific hash formats by performing a time-memory trade-off, making it exceptionally fast for common passwords. The tool comes with pre-generated tables, significantly reducing the computational effort required compared to on-the-fly cracking methods.
- ✗
John the Ripper
Why it's wrong here
John the Ripper is a powerful, open-source password cracker renowned for its versatility across numerous hash types and operating systems, including Unix, macOS, and Windows. While it can crack Windows LM/NTLM hashes, its primary methods involve dictionary attacks, brute-force, and custom rules, rather than relying exclusively or primarily on precomputed rainbow tables. It is not specifically designed for Windows LM/NTLM cracking with rainbow tables as its defining feature, unlike Ophcrack.
- ✗
Cain & Abel
Why it's wrong here
Cain & Abel is a comprehensive password recovery tool for Microsoft operating systems, offering a wide array of functionalities beyond simple hash cracking, such as network sniffing, ARP poisoning, and VoIP recording. Although it can crack various hash types, including LM and NTLM, it employs diverse methods like dictionary attacks, brute-force, and cryptanalysis, and is not exclusively or primarily focused on using rainbow tables for Windows hash cracking. Its broad toolkit makes it a general-purpose auditing utility rather than a specialized rainbow table cracker.
- ✗
Hashcat
Why it's wrong here
Hashcat stands out as a highly performant, GPU-accelerated password recovery tool supporting an extensive range of hash algorithms across different operating systems and applications. It excels at various attack modes, including dictionary, brute-force, mask, and hybrid attacks, leveraging parallel processing capabilities of modern graphics cards for speed. While capable of cracking Windows LM/NTLM hashes, Hashcat is a general-purpose cracker optimized for speed across many hash types and attack vectors, not specifically designed around rainbow tables for Windows.
Go deeper
Related to this question
About these practice questions
One of 870 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.