There's no way to do this with Crunch that I'm aware of.
The only way I know of to do this is the generate all masks that conform to the composition rules using the policygen tool from the PACK toolkit, as described in my answer here.
In your case, it would be something like:
$ policygen --minlength=8 --maxlength=12 \
--mindigit=2 --minlower=1 --...
This is quite an old thread but I feel still relevant especially for new comers like myself who are starting out learning to crack WEP.
I have exactly the same problem and I am using a similar wifi card (AWUS036NHA).
Until I get another manufacturer such as Panda I won't know if this is a problem with the ALFA cards.
NB: If the target AP has a an active ...
You will have to check AAAAAAAA-AZZZZZZZ, but that's still 26 times faster than checking AAAAAAAA-ZZZZZZZZ.
That speed increase is significant, so knowing the first character (or any other character) is really worth it.
If the passphrase is exactly 8 characters long and the first character is known, then only 7 need to be brute forced. Assuming characters are 0‒9 and A‒Z, the maximum number of combinations is 367.
An AMD Radeon RX480 GPU can go through approximately 170,000 candidate WPA2 passwords per second. This means it will take around 367 / 170000 seconds at most to ...
This is a bad idea.
You need your passwords to be unique. Re-using 95% of a previous password doesn't respect this rule, so you should really avoid it.
If an attacker manages to get access to one database with cleartext passwords, he will most likely understand how your password was generated, and will be able to guess all your other passwords.
You should ...
You're looking for hashcat's related tool princeprocessor, also by hashcat's author. It's specifically designed for multiword passphrases and similar "combination" work.
A killer PRINCE feature is that it does all of the combination work for you without having to store all combinations on disk (which is probably what you meant by "heavy"?)