hashcat Forum

Hi all,

Up until now, I've been using mostly masks for any hash attacks. I'm currently handling a case where I have a general idea of how a password is structured, but I don't have any information regarding any character placement, for example:

I know my password:

1. Is exactly 10 characters long
2. Contains 1 or 2 numbers
3. Contains 1 or 2 upper case characters
4. Contains exactly 1 special character
5. All other characters are lower case

There isn't any way for me to convey these rules into a mask since I'll need to know the character exact positions to actually be able to use this knowledge to my benefit.

How do you guys generate these precise candidates?

Sounds like a job for policygen from PACK https://github.com/iphelix/PACK
It will generate a mask file for you and also give you a rough estimate of how long it will take to complete.
Using your example it would take almost 57 days to complete with a speed of 100GH/s