It sound like what you want to do is something like a hybrid attack where you combine a list of words with number and special characters at the beginning or end. See this article, scroll down to "Hybrid attack":
https://in.security/2022/06/20/hashcat-p...sk-hybrid/
For example:
hashcat -a 6 -m 0 <$hash> rockyou.txt -1 ?s?d ?1?1?1?1 -i
hashcat -a 7 -m 0 <$hash> [i]-1 ?s?d ?1?1?1?1 -i rockyou.txt [/i]
The above examples would search for a word in the rockyou.txt list followed by up to four characters being either a number or special characters (-a 6), or up to four numbers or special characters followed by a word (-a 7). The "-i" part means the mask part is incremental, meaning 1 character up to the end of the mask are tried.
What I am missing in your question is specific information:
1) The order of numbers and letters random -> use a mask attack
2) Are letters non-random such as words -> huge difference since you can use a dictionary limiting the number of passwords to check. In this case use hybrid attack
3) Which characters, most people use only some special characters not all in their password. In such a case you can make a spefic mask for those characters, e.g. mask "-1 @?d ?1?1?1?1 -i" would only search for character "@" and digits/numbers, not all characters.
4) What is known about the order or words/letters/special characters
In other words, be specific!
https://in.security/2022/06/20/hashcat-p...sk-hybrid/
For example:
hashcat -a 6 -m 0 <$hash> rockyou.txt -1 ?s?d ?1?1?1?1 -i
hashcat -a 7 -m 0 <$hash> [i]-1 ?s?d ?1?1?1?1 -i rockyou.txt [/i]
The above examples would search for a word in the rockyou.txt list followed by up to four characters being either a number or special characters (-a 6), or up to four numbers or special characters followed by a word (-a 7). The "-i" part means the mask part is incremental, meaning 1 character up to the end of the mask are tried.
What I am missing in your question is specific information:
1) The order of numbers and letters random -> use a mask attack
2) Are letters non-random such as words -> huge difference since you can use a dictionary limiting the number of passwords to check. In this case use hybrid attack
3) Which characters, most people use only some special characters not all in their password. In such a case you can make a spefic mask for those characters, e.g. mask "-1 @?d ?1?1?1?1 -i" would only search for character "@" and digits/numbers, not all characters.
4) What is known about the order or words/letters/special characters
In other words, be specific!