Passwords are not stored in plaintext, they are stored in a file that 
contains cryptographic hashes. Hashes are often called one-way functions 
because they accept some input, then run that input through an equation 
that cannot be reversed. Hash functions can take a variable length user 
input such as "caroline" and output a hexadecimal value that is of fixed 
length. There is no way to take that hexadecimal value and reverse the 
equation to determine the original input. Another important aspect of 
cryptographic hashes is that the output appears random. A good hash 
function should change at least fifty percent of its output if just one 
bit is changed in the original input. Well designed hash functions 
should also minimize collisions. Collisions occur when two different  
inputs generate the same output.
 
When you log onto a system, that system does not actually know your 
password, but it does have a stored username with a hash value. If you 
input the correct password, the hash function will create a matching 
hash and allow you to log into your system 

There are three main types of attacks on passwords. A brute force method 
is the most obvious. You could sit and just guess the password starting 
with a, then b, then c, and so on until eventually you get the password. 
Of course a computer can try it much faster. Often, an attacker will 
pull the file containing the password hashes and then run a program that 
will automatically try every password until it can generate the matching 
hash. A program like Cain and Abel running on a reasonably powerful 
machine can attempt several million passwords a second. However, brute 
force is often the last resort when all other methods have failed 
because even on a computer running millions of attempts per second, the 
time it takes to crack a password increases exponentially with every 
extra character in that password.

If we take a limited character set, let's say a through z in lower case 
only, we have 26 possible characters that we can use in a password. If 
our password is only one character in length, then there are 26 possible 
combintations and a computer will crack that password in a tiny fraction 
of a second. If our password is two characters, then there are 676 
possible combinations. For three characters there are 17,576 
combintations. Once you get to about eight or nine characters it starts 
to get interesting. And if you password is ten characters long there are 
141,167,095,653,376 possible combinations. If your computer is capable 
of 6 million attempts a second it would take approximatley 272 days to 
attempt every password. And if you used a 12 character password that 
same computer would take 500 years to exhaust all possible passwords. In 
cryptographic terms this is called infeasible; though it is technically 
possible for me to crack a password, by the time I have accomplished it, 
the information will most likely be of no value. In this example I have 
not even used the full ascii key set; it is possible to use upper and 
lower case passwords in a modern login password as well as special 
characters like exclamation points and ampersands to increase the 
possilbe character set.

Because brute force attacks are often infeasible, dictionay attacks were 
created to prey on the human nature of passwords. A fourteen character 
password made of nothing but special characters and numbers may be 
extremely hard to break, but it is also extremely hard to remember. 
People will often use common english words or names as passwords, so 
most password crackers have the ability to use dictionaries, in this 
case lists of words that may be likely to be used as passwords - english 
words, proper names, place names, etc. Cain and Able even contains a 
utility to substitue numbers for letters in a dictionary word, so that 
in adition to "password" it will also try "p4$$w0rd" and many 
permutations, a technique often recommended to introduce special 
characters into an easily remebered password.

The newest technique is a pre-computed table attack, sometimes refered 
to as a rainbow table. This takes advantage of the large hard drives 
availible today to compute all the hashes of a particular function and 
save the results. When a rainbow table is used, the computer simply 
compares the value on the table with the hash to be cracked, thereby 
saving the time that would be required to compute that hash. Cain and 
Abel also supports rainbow tables, however the most well known 
implementation is probably ophcrack. Ophcrack can be run as a 
stand-alone utility on windows or linux, and they also produce a live-cd 
that automatically boots into a linux operating system, extracts the 
password hashes, then loads the rainbow tables into memory and cracks 
them. All the user needs to do is put in the CD and reboot the computer. 
When I have used ophcrack, I have recovered virtually every password 
within ten minutes.

With ever larger hard drives and fast internet connections, rainbow 
tables have become a very common way to crack passwords once a 
dictionary attack has failed. However, they are still stymied by long 
passwords due to hard drive limits. A rainbow table that stores NTLM 
hashes, the hashes used by a typical Windows system, that contain upper 
and lower case characters as well as numbers up to a length of 8 
characters takes approximately 210 gigabytes of space.

Pre-computed tables are also easily defeated by a technique known as 
salting. A salt is a random value that is concatonated with the user's 
password before it is hashed. Becaise the attacker will not know this 
value until they attempt to compromise a particular machine's password, 
they cannot compute a rainbow table ahead of time.