Bruteforce with descending characters - zzz,zzy,zzx

[philsmd]

yeah.
but even for the approach with testing first password candidates at the end, you could actually just use -s / -l until the whole keyspace was tested, i.e. split your keyspace in x chunks and test the later chunks first.