02-20-2011, 10:09 AM
that is absolutly correct. the brute-force idea was ok in the past where hashes were ciphers and therefore limited somehow. for example DES which is limited to 8 chars or its children like LM which is limited to 7 chars or DEScrypt which is limited to 7 bit charset. real hashes (not ciphers) like md5 or sha1 so not have this limitation. that is why all hashcat utils focuses wordlist based attacks like hybrid, combination, fingerprint, permutation, table-attack or rule-based.