Rainbow Table Attack in Flask

A rainbow table attack exploits weak password storage by precomputing hash-to-plaintext mappings. While traditionally a desktop security concern, it directly impacts Flask APIs when authentication endpoints use unsalted hash comparisons.

Flask's default JWT implementations or basic password checks often rely on werkzeug.security.generate_password_hash with method='md5' or 'sha1'. This creates predictable hashes that attackers can precompute. For example:

# Vulnerable Flask route

from flask import Flask, request
from werkzeug.security import check_password_hash
app = Flask(__name__)

@app.route('/login', methods=['POST'])
def login():
    username = request.json.get('username')
    password = request.json.get('password')
    stored_hash = db.get_user_hash(username)
    if check_password_hash(stored_hash, password):
        return {'status': 'success'}
    return {'error': 'Invalid credentials'}, 401

# If stored_hash was generated with unsalted MD5

# Example: db.save_user('admin', '5f4dcc3b5aa765d61d8327deb882cf99')

# Attacker then uses rainbow table lookup to reverse '5f4dcc3b5aa765d61d8327deb882cf99' → 'password'

When Flask APIs expose authentication endpoints without rate limiting or exponential backoff, attackers automate credential stuffing using real username lists against these endpoints. The absence of multi-factor authentication compounds vulnerability, allowing direct hash comparison against precomputed tables.

For instance, a Flask endpoint at /api/v1/auth/login accepting JSON payloads fails if it returns HTTP 200 for valid credentials but HTTP 302 for invalid ones — this differential response reveals successful matches without explicit error messages.

middleBrick detects this through its Authentication category by analyzing response patterns and comparing them against known attack signatures. It flags endpoints where:

• Response time varies significantly between valid and invalid credentials
• Error messages lack detail but HTTP status codes differ
• Multiple failed attempts trigger no account lockout

During scanning, middleBrick sends credential pairs with hashes matching common rainbow table entries (e.g., MD5('password'), SHA1('123456')) to test for unauthorized access. It logs whether the response indicates successful authentication, indicating potential table lookup success.

This attack vector is particularly dangerous in Flask APIs serving fintech or healthcare applications where user credentials are reused across systems. The OWASP API Top 10 classifies this as Broken Object Level Authorization when authentication logic leaks through endpoint behavior.

Compliance frameworks like PCI-DSS Requirement 8.3 and GDPR Article 32 require strong authentication mechanisms. Flask APIs handling payment data must avoid unsalted hash storage to prevent credential harvesting via rainbow tables.

middleBrick performs black-box scanning of Flask APIs without requiring credentials or configuration. It identifies rainbow table vulnerabilities by probing authentication endpoints with known hash patterns and analyzing response anomalies.

When scanning https://api.example.com/login, middleBrick sends POST requests with payloads containing:

• Common unsalted hash values: {'password': '5f4dcc3b5aa765d61d8327deb882cf99'}
• Weak salts: {'password': 'a1b2c3d4'}
• Default admin credentials

The tool observes whether responses indicate successful authentication through:

• HTTP 200 status instead of 401
• Presence of session cookies or JWT tokens
• Differential response timing (>50ms variance)

For example, a vulnerable Flask endpoint might return:

HTTP 200 OK
{