I have been researching SHA algorithms extensively, specifically SHA1, SHA2-256, SHA2-512, SHA3-256, and SHA3-512, and have found many instances of successful collision attacks as well as methods.
In my list are the following:
- Brute Force attacks
- Birthday attacks
- Yuval's Birthday attack (improved birthday attack with different conditions)
- Reduced round attacks
- Successful on attacks on all SHA algorithms, SHA1, SHA-2, and Keccak ("Parent" function of SHA-3)
- Chosen Prefix attacks
- Successful on SHA1, more info: https://shattered.io/.
As well as attacks that defeat the security provided by algorithms in application.
- Length extension attacks
- SHA-3 is invulnerable due to the concatenation of capacity during permutations of Keccak sponge function.
I have excluded Brute force attacks (when not about finding collisions), including dictionary attacks, as well as rainbow tables since these are vulnerabilities created by something external to the algorithm itself.