To increase the odds of cracking offline password hashes, which technique should you use?

• A. Use a dictionary attack with a comprehensive wordlist
• B. Use a rainbow table attack
• C. Run a brute-force attack with no constraints
• D. Attempt online authentication against the target with trial passwords

Answer: (A)

When cracking offline password hashes, using a comprehensive wordlist in a dictionary-style attack is the most efficient way to maximize how many passwords you can recover. Many users choose passwords that are real words or simple variations of them. By compiling a broad wordlist and applying common transformations (like capitalization changes, leet substitutions, or appended numbers), you can quickly test a large, plausible set of guesses against each stored hash. Since you’re working offline, you aren’t slowed by login attempts or rate limits, so you can hash each candidate with the exact salt and algorithm used for the target and compare it to the captured hash. This approach exploits the real-world distribution of passwords to hit a large fraction of targets with relatively few guesses.

Rainbow tables become less practical in modern contexts because many systems store salted hashes; salts require a unique table per salt, making rainbow tables unwieldy and less effective. Brute-forcing with no constraints would eventually try every possible combination, but the keyspace grows exponentially and quickly becomes infeasible even with offline resources. Attempting online authentication against the target isn’t a feasible or ethical way to discover password hashes and is typically blocked by defenses and would not leverage the offline hash you’re trying to crack.