What attack to use?

[epixoip]

If you want "abc" then combinator3.bin is precisely what you want... If your wordlist contains the following:

Code:

apple
banana
cocknose

Then ''./combinator3.bin wordlist wordlist wordlist'' is going to generate:

Code:

appleappleapple
appleapplebanana
appleapplecocknose
applebananaapple
applebananabanana
applebananacocknose
applecocknoseapple
applecocknosebanana
applecocknosecocknose
bananaappleapple
bananaapplebanana
bananaapplecocknose
bananabananaapple
bananabananabanana
bananabananacocknose
bananacocknoseapple
bananacocknosebanana
bananacocknosecocknose
cocknoseappleapple
cocknoseapplebanana
cocknoseapplecocknose
cocknosebananaapple
cocknosebananabanana
cocknosebananacocknose
cocknosecocknoseapple
cocknosecocknosebanana
cocknosecocknosecocknose

And you can pipe this directly into oclHashcat via stdin if you'd like.

But now you're also saying 8-18 words? Not making much sense, especially since you also previously said the password is only 24 characters max. Anyway, all the pieces are here for you to formulate your attack.