Generating more precise candidates

[xabbix]

Hi all,

Up until now, I've been using mostly masks for any hash attacks. I'm currently handling a case where I have a general idea of how a password is structured, but I don't have any information regarding any character placement, for example:

I know my password:

1. Is exactly 10 characters long
2. Contains 1 or 2 numbers
3. Contains 1 or 2 upper case characters
4. Contains exactly 1 special character
5. All other characters are lower case

There isn't any way for me to convey these rules into a mask since I'll need to know the character exact positions to actually be able to use this knowledge to my benefit.

How do you guys generate these precise candidates?

[hops]

Sounds like a job for policygen from PACK https://github.com/iphelix/PACK
It will generate a mask file for you and also give you a rough estimate of how long it will take to complete.
Using your example it would take almost 57 days to complete with a speed of 100GH/s