Let's assume the following situation:
The attacker has extracted 1000 password hashes from a website (
vuln.com) along with all their usernames and hashing algorithm (assume
bcrypt). The only piece of information stopping them from cracking all the hashes is the missing passwords and salts. Assume the salts are all cryptographically random.
What would change if the attacker also has all the salts?
What are the differences between cracking the hashes with and without knowing the salts?