(07-20-2020, 01:46 PM)philsmd Wrote: it's just showing you a whole set (a range) of password candidates. The displayed password candidates in the "Candidates.#" line within the status output are neither meant to be complete, nor can they show you each and every mangled password candidate. They are only indicative such that the users see *some* of the passwords (the first password from a huge set and the last password from a huge set).

If you want to see all of them, you could use this:

Code:

hashcat --stdout -a 0 -r rules/best64.rule rockyou.txt

This --stdout feature can be used for troubleshooting / debugging too, it will include the whole set of password candidates (if you use the correct / same parameters as with the command including the cracking, without the --stdout, but with the hash file).

of course the --stdout output can be very large and therefore you might need to either filter ("grep" in linux) it or limit it ("head"/"more"/"tail" in linux) etc

(07-20-2020, 02:12 PM)philsmd Wrote: in general, it only happens that both the left and right part of the "->" sign are equal if you are testing with only one password candidate... but it could also happen that by chance several (mangled with rules etc) password candidates are equal and therefore the set of password candidates that you are trying are not unique.

With fast hashes it's not a huge problem if not ALL of the password candidates are unique, but for slow hashing algorithms like bcrypt/scrypt/pbkdf2 with high cost factors/iterations etc, it could matter a lot and therefore the user is responsible to avoid duplicate input by using more clever attack types or better rules that do not produce many duplicates.