Why not reverse the client’s source a bit. Most times there’s a off-by-one or other option to exploit it.
Hydra – guess it’s just not my style. You could try Medusa or John, or even CUDA API in C – and speed this up as long as you know whether the policy isn’t harmed, causing logfiles. Therefore footprint that before you start anything.