I'm testing out John the Ripper (1.7.9 Jumbo 7) on a file containing MD5 hashes without any usernames. I've been experimenting with different rules and configurations – I am currently using a wordlist and I am applying the
--rules=single command. As a result of running this command, I'm getting very good results with it, however, I can't seem to understand what is happening under the hood because of the following paragraph I found on Openwall's website:
'Single Crack' Mode: This is the mode you should start cracking with. It will use the login names, "GECOS" / "Full Name" fields, and users' home directory names as candidate passwords, also with a large set of mangling rules applied. Since the information is only used against passwords for the accounts it was taken from (and against password hashes which happened to be assigned the same salt), "single crack" mode is much faster than wordlist mode. This permits for the use of a much larger set of word mangling rules with "single crack", and their use is always enabled with this mode. Successfully guessed passwords are also tried against all loaded password hashes just in case more users have the same password.
Note that running this mode on many password files simultaneously may sometimes get more passwords cracked than it would if you ran it on the individual password files separately.
I'm confused by the statement "single crack" mode is much faster than wordlist mode. How come single mode is is faster than a simple dictionary attack if word mangling rules are being applied?
Any insight into what goes on in single mode cracking would be appreciated, since I can't seem to find much documentation other than that paragraph.