Here's how to do it with john (the "jumbo" version), using
head to just show the first ten lines of output:
$ john -1='02' -mask=091?1?d?d?d?d?d?d --stdout | head
Press 'q' or Ctrl-C to abort, almost any other key for status
And for what it's worth, you can also pipe hashcat output to another tool, using hashcat's
--stdout option, following @dandavis' suggestion:
$ hashcat -a 3 -1 02 091?1?d?d?d?d?d?d --stdout | head
In both cases above, we're defining a custom character set "1", containing the two characters '0' and '2', and then using it in the mask with
But you don't really want to do either of these. There's no need to pipe a wordlist to anything, because starting with hashcat 4.0.0, you can skip aircrack-ng entirely, and directly crack a WPA2 PSK with hashcat (using
$ hashcat --quiet -a 3 -m 2500 hashcat.hccapx hash?l?l?l?s
So your command would probably look something like:
$ hashcat -a 3 -m 2500 -1 '02' hashcat.hccapx 091?1?d?d?d?d?d?d
For fast hashes, this is the most efficient method, as the candidate passwords will be generated much faster on GPU. For a slow hash like WPA2, it doesn't make much of a difference in efficiency.
For more information, see this reference, as well as the closely related hcxtools project, which you may need in order to convert your captured PSK into the hccapx format required by hashcat.