A common method to mitigate the effect of rainbow tables is to add a string to the end of the user password before hashing, a process known as salting.
However, let’s say for example that someone uses a certain password across multiple websites which all salt their passwords, all use the same cryptographic hashing function, and are all have their database leaked.
Can having multiple salted hashes of the same password (and the associated plaintext salts), help an attacker break either pre-image or second pre-image resistance?
I.e. given this information, does an attacker have a better strategy than brute force?
If so, do different prevalent cryptographic hashing functions vary in their susceptibility to this kind of attack?
Also if so, is there a more optimal salting strategy that resists this kind of attack?
SHA-256(password || salt)
or similar, which should never be used because regular hash functions are extremely efficient for attackers to run. $\endgroup$