hashcat Forum - performance masks vs. wordlists

As far as I understand, there is not much of a performance difference when attacking smaller compared to larger hashlists (fast hashes) with oclHashcat.

For (self) education purpose I have put together a quick and dirty bash script for my single 7970 Ubuntu 12.04 LTS setup. Basically doing bruteforce against 1-6 characters ?a, two PACK-generated masks (7-8 full and 9-11 with a treshold of 22 each running 10 min), rules against two large and one small wordlist (splitlenged), hybrid attacks and a basic fingerprint attack against 10k worst passwords then fingerprint against found passwords.

Question: On a bigger hashlist (100k-500k) of fast hashes should I first run the bruteforce/mask attacks and then the wordlist attacks or vice versa - assuming for this case in theory both "blocks" of attacks would find 25% of the passwords? In other words: Does one of the modes benefit from less left hashes?

I haven't found info on that in the wiki or forum, maybe just because it does not make any time difference when running the script.

(01-10-2014, 02:19 PM)vrposter Wrote: [ -> ]As far as I understand, there is not much of a performance difference when attacking smaller compared to larger hashlists (fast hashes) with oclHashcat.

this generally is not true. but it depends on how large large is, and what gpu you have. radeons have terrible memory controllers, so large hash list performance is generally much slower than small hash list performance. but this is not true for most nvidia gpus since nvidia has a great memory controller. try loading up 3 million hashes on your 7970 and you will see what i mean.

(01-10-2014, 02:19 PM)vrposter Wrote: [ -> ]Question: On a bigger hashlist (100k-500k) of fast hashes should I first run the bruteforce/mask attacks and then the wordlist attacks or vice versa

typically i brute force len 1-6 on gpu while simultaneously doing a straight wordlist attack on cpu. then i do rule-based attacks on the gpu. on truly large hash lists (like 2+ million, 500k isn't that big) you will want to do your first attacks on cpu so that you don't incur any performance loss while eliminating as many hashes as possible to get the hash list down to a size that works well on gpu. so usually wordlist + best64 on cpu first, then move to gpu.

Thx a bunch epixoip! I was not aware of that. I'll modify my script the way you described. Happy me to learn step-by-step!