04-11-2011, 01:00 PM
nope, its exactly doing what it is supposed to do. remember there is a length limit on each side (14). oclHashcat automatically skips words that are longer than 14 chars. it is -not- depeding on rules. but what you maybe did not take into calculation is that NTLM doubles the length of each word since NTLM plains converted to unicode before hashed. that means, including your rule from above, max length of the words in ../dico/rockyou.txt is 5! here is the proof:
Quote:root@sf:~# perl -ne 'chomp; next if length > 5; print $_, "\n"' < dict/rockyou.txt | wc -l
279910