Skip to content

roycewilliams/kens-salty-rainbow

master
Switch branches/tags
Code

Latest commit

 

Git stats

Files

Permalink
Failed to load latest commit information.
Type
Name
Latest commit message
Commit time
img
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 

Rainbow candy coated with sugar

ken's Salty Rainbow

ken's Salty "Rainbow" is a search-engine-discoverable archive of descrypt (traditional Unix DES crypt) hashes for 7180 common passwords and variants - especially default passwords, temporary passwords, and generic operational/lab/development passwords.

Why?

Rainbow tables are largely dead for most password-cracking use cases (even for unsalted hashes).

But as the historical (and historic) salted hash, descrypt is a unique hybrid: slow enough to take time to exhaust, but fast enough (and truncated enough) to make naive lookup useful for non-specialists (who are desperate and Googling).

The descrypt hash format also still seems to be the default for a number of embedded platforms.

This all means that descrypt is perhaps the only standard salted hash for which a rainbow table (or other lookup) might still be useful - hence the name.

This repository should illustrate - to developers, embedded platform architects, and IoT manufacturers - that choosing descrypt has been a bad idea for some time ... and will only get worse.

(And to be clear, I think that descrypt was a pretty brilliant improvement when it was introduced, and I'm a huge fan. But its time has passed.)

Interesting examples

  • Some Palo Alto gear uses 'admin' as the default password, configured by default with the same salt every time

    • fnRL/G5lXVMug:admin
  • DSL-2750u routers with PTCL firmware have these hard-coded default credentials:

    • admin kcCkosSQIzsyI:admin
    • user tFXuAIJGpWSdY:user
    • support 3YpechUwDY1Fc:support

Notes

  • All 4096 valid salts for the original descrypt algorithm are used here. Some implementations of descrypt may use invalid characters in the salt.
  • Because descrypt truncates passwords at eight characters, "actual" passwords (as intended by the person who chose them) may vary.
  • Yes, I know that this isn't actually a rainbow table. That would be massive overkill for this use case. Instead, we harness the power of search-engine indexing of GitHub. I just couldn't pass up the name.

Related work

References

About

An archive of descrypt hashes for common non-personal passwords

Resources

License

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages