The attacks: brute force, dictionary, rainbow tables

If an attacker steals the database of hashes, how do they actually go about recovering the passwords? Three classic attacks, from the most naive to the most fearsome.

Brute force

Brute force consists of trying every possible combination of characters, one by one: a, b, ... aa, ab, ... until finding the one whose hash matches.

Its effectiveness depends on the length of the password. A 6-character password falls in a few seconds; each added character multiplies the effort. Length therefore matters more than apparent complexity.

The dictionary attack

Humans choose bad passwords. Rather than trying everything, the dictionary attack first tests a list of common passwords: 123456, password, azerty, first names, and previous breaches.

It is far more effective than pure brute force, because a huge fraction of users choose an already-known password. Variants are added (Password1, p@ssword).

Rainbow tables

The most elegant attack exploits the fact that hashing is deterministic. An attacker can precompute in advance the hashes of billions of passwords and arrange them in a huge table. This is a rainbow table.

Then, faced with a stolen hash, they only need to look it up in the table to read the corresponding password — almost instantly. The expensive computation was done once and for all, in advance.

                stolen hash : 5f4dcc3b5a...
                        |
                        v
   +----------- precomputed table -----------+
   | 5f4dcc3b5a...  ->  "password"           |
   | e10adc3949...  ->  "123456"             |
   | 8621ffdbc5...  ->  "abc123"             |
   +-----------------------------------------+
                        |
                        v
             password recovered : "password"

The Achilles' heel: identical hashes

All these attacks are amplified by a flaw in raw hashing: two users with the same password have exactly the same hash.

Alice : "soleil2024" -> hashing -> a1b2c3d4...
Bob   : "soleil2024" -> hashing -> a1b2c3d4...   (identical!)

Direct consequences:

• the attacker spots at a glance who shares a password;
• cracking a single hash reveals all the accounts that use it;
• a single rainbow table works against every database in the world.

Attack recap

Attack	Principle	Cost to the attacker
Brute force	Every combination	High, grows with length
Dictionary	Common passwords first	Low if password is weak
Rainbow table	Precomputed hashes, then lookup	Precomputation done only once

In summary

• Brute force: try every combination; length is the best defense.
• Dictionary: test common passwords first.
• Rainbow table: precomputed hashes allowing an unsalted hash to be inverted almost instantly.
• Without protection, two identical passwords produce the same hash: a single table cracks everyone.