# Depth-first search
# Max length = 20
1234
1234a
1234aa
1234aaa
1234aaaa
...
1234aaaaaaaaaaaaaaaa
1234b
1234bb
...

##</code><code>##

# Breadth-first search
1234
1234a
1234b
1234c
...
12348
12349
1234aa
1234ab
1234ac
...

##</code><code>##

use strict;
use warnings;

sub crack {
   my $hint       = shift;
   my $target     = shift;
   my $salt       = substr($target, 0, 2);
   my @chars      = @_;
   my @to_process = ( '' );
   my $passwd;

   while (@to_process) {
      my $pad = shift(@to_process);

      push(@to_process, $pad . $_)
         foreach @chars;
   
      for my $pos (0..length($pad)) {
         $passwd = $pad;
         substr($passwd, $pos, 0, $hint);

         return $passwd
            if crypt($passwd, $salt) eq $target;
      }
   }
}

my @chars = ('a'..'z', 'A'..'Z', '0'..'9');

print crack('12',   crypt('d12e',    'AA'), @chars), "\n";
print crack('1234', crypt('aa12345', 'AA'), @chars), "\n";