Certified Ethical Hacker (CEH) Practice Question

Rainbow tables rely on pre-computed hash values that assume no per-password randomness. Bcrypt automatically generates a unique 128-bit salt for every password and repeats the hashing process thousands of times, so an attacker would have to recompute tables for every individual salt value, making the attack impractical. Simply switching to SHA-256 keeps the data vulnerable because it is still fast and unsalted. Adding a static pepper helps only if the pepper remains secret; once exposed, rainbow tables can be built again. Encrypting hashes with a hard-coded AES key just converts the problem to key recovery and still leaves deterministic ciphertexts that can be compared offline.