Including rule used in output

[Snoopy]

take a look at hashcat options:

Code:

--debug-mode              | Num  | Defines the debug mode (hybrid only by using rules)  | --debug-mode=4
--debug-file              | File | Output file for debugging rules                      | --debug-file=good.log

- [ Rule Debugging Modes ] -

  # | Format
===+========
  1 | Finding-Rule
  2 | Original-Word
  3 | Original-Word:Finding-Rule
  4 | Original-Word:Finding-Rule: Processed-Word

so in your case (your are only interested in the rule) it would be sufficent to use debug mode 1, otherwise use 4 and split the rules afterwards) with debug file, then u will need some runs with different dicts, attacktargets and rules (also generated rules), delet any potfile after each run or disable potfile (to be able to crack same pass with different rules) and then sort/count the debugfile (linux sort debugfile | uniq -c )

the output would be a file like this ( the file was already processed, so the number in front is the number how often a specific rules was able to crack a password) some basic fast runs with different dicts and attacktargets

Code:

  4257 T0
  2972 :
  2907 $1 $2 $3
  2369 si1
  1967 se3

so these 5 rules are the top 5 for this fast test runs

T0 = Toggle first char
: do nothin
append 123
replace all i with 1
replace all e with 3

but as you mentioned, these is very dependend to targets and dicts used