A hybrid attack combines a word from a dictionary with characters from a mask. The word supplies one part of the password, and the mask supplies additions such as a year or a couple of digits.
There are three attack modes that do this. -a 12 is the general one and can do everything the other two can, so if you are learning only one, learn that one.
-a 12 - you write a mask and mark inside it where the word goes-a 6 - word first, then the mask-a 7 - mask first, then the word
In -a 12 you write one mask for the whole candidate. Inside that mask, ?w stands for the word from your dictionary. Everything else in the mask works exactly as it does in a normal mask attack.
Because you place ?w yourself, the word does not have to sit at the start or the end. It can sit in the middle:
$ ... -a 12 ?d?w?d?d example.dict
With password in the dictionary, that gives 0password00 through 9password99.
You can also type fixed characters directly into the mask:
$ ... -a 12 ?w2024! example.dict
That appends 2024! to every word, and no other candidate is tried.
?w is required, and you use it exactly once.?l ?u ?d ?s ?a ?h ?H ?b all work, and so do custom charsets from -1 to -8.
?q stands for a word from a second dictionary. It is optional, and it has to come after ?w. When you use it, you name two dictionaries on the command line, the one for ?w first:
$ ... -a 12 ?w-?q! left.dict right.dict
If left.dict holds alice and right.dict holds bob, that produces alice-bob!.
This makes -a 12 a superset of the Combinator attack as well: -a 12 ?w?q joins two dictionaries the same way -a 1 does, except that now you may also put characters between them and around them.
If your example.dict contains:
password hello
The configuration:
$ ... -a 6 example.dict ?d?d?d?d
generates the following password candidates:
password0000 password0001 password0002 . . . password9999 hello0000 hello0001 hello0002 . . . hello9999
It also works on the opposite side!
The configuration:
$ ... -a 7 ?d?d?d?d example.dict
generates the following password candidates:
0000password 0001password 0002password . . . 9999password 0000hello 0001hello 0002hello . . . 9999hello
-j applies a single rule to the word on the left and -k applies one to the word on the right, before the pieces are glued together. Neither of them ever applies to a mask, because a mask is not a word.
-r is accepted here and applies to the finished candidate. -j and -k still take a single rule each for one side of the input, which is the one thing -r cannot express.
Using rules to emulate hybrid attack describes how to build a brute-force rule file with maskprocessor and get a hybrid attack that way. That trick was written when there was no way to put the mask in the middle. -a 12 does that directly now, so the rule file is no longer needed.