01-05-2018, 09:37 AM
no, I don't think that a mask attack with a charset of ?a in each position is a good strategy.
Since -m 11300 is a slow hashing algorithm I would recommend to remember as much as possible from the password and try to come up with some policies that limit the keyspace and therefore number of password candidates a lot.
That said, very small mask attacks might be okay even for a slow hashing algorithm but not something like you said "at least 13-25" characters. That's not even possible to brute-force for very fast hashing algorithms like NTLM or MD5.
It therefore would make sense to remember all the policies and either generate (or hand-craft) a (small) dictionary file in advance and run it with hashcat or use a small input dictionary file and use some rules (see https://hashcat.net/wiki/doku.php?id=rule_based_attack)
Since -m 11300 is a slow hashing algorithm I would recommend to remember as much as possible from the password and try to come up with some policies that limit the keyspace and therefore number of password candidates a lot.
That said, very small mask attacks might be okay even for a slow hashing algorithm but not something like you said "at least 13-25" characters. That's not even possible to brute-force for very fast hashing algorithms like NTLM or MD5.
It therefore would make sense to remember all the policies and either generate (or hand-craft) a (small) dictionary file in advance and run it with hashcat or use a small input dictionary file and use some rules (see https://hashcat.net/wiki/doku.php?id=rule_based_attack)