Crack a password program (crypt())

//Daniel Lawson
#define _XOPEN_SOURCE
#include <unistd.h>
#include <stdio.h>
#include <cs50.h>
#include <string.h>
string getPassword(string hash, string salt, char letters[], char output[]);

//void getPasswordRecursive(string hash, string salt, char letters[], int max, int startStrInt); //explanation for this further down...
int main(int argc, string argv[])
{
    if (argc != 2)//make sure they entered two arguments
    {
        printf("enter two args (./crack 50jKHl3SFaNms)\n");
        return 1;
    }
    char salt[3]; //create a string for the salt
    salt[0] = argv[1][0]; //get the first character of the salt
    salt[1] = argv[1][1]; //get the second character of the salt
    salt[2] = '\0'; //add a null terminator
    string hash = argv[1]; //get the hash
    char letters[52]; //create an array for all possible letters
    for (int i = 0; i < 26; i++) //fill the array with lowercase and capital letters
    {
        letters[i] = (char) 97 + i; //capital
        letters[i + 26] = (char) 65 + i; //lowercase
    }
    char output[5]; //array to store output, must be created outside of the function,
    //so the memory allocated to the array is not cleared
    string password = getPassword(hash, salt, letters, output); //call  function getPassword
    printf("%s\n", password); //print the password
    //getPasswordRecursive(hash,salt,letters, 4, 0); //call the recursive version, get the same output (it doesn't work right now..)
    return 0;
}

/*hash stores the hash (including the salt), salt stores the seperated salt
letters stores the possible characters, output stores possible passwords and returns the password
why use a method with a return type? allows you break out of the function as soon as the answer is found
*/

string getPassword(string hash, string salt, char letters[], char output[])
{

    for (int i = 0; i < 52; i++)//try a string starting with each character
    {
        output[0] = letters[i];//add a character to output
        output[1] = '\0'; //add a null terminator
        if (strcmp(crypt(output, salt), hash) == 0) //test the current state of output
        {
            return output;
        }
        for (int j = 0; j < 52; j++) //add another character to each previous character combination
        {
            output[1] = letters[j];//add a character to output, preserving previous characters from this loop
            output[2] = '\0'; //add a null terminator
            if (strcmp(crypt(output, salt), hash) == 0) //test the current state of output
            {
                return output;
            }
            for (int k = 0; k < 52; k++)
            {
                output[2] = letters[k];//add another letter, preserving the previous two
                output[3] = '\0'; //add a null terminator
                if (strcmp(crypt(output, salt), hash) == 0) //test the current state of output
                {
                    return output;
                }
                for (int l = 0; l < 52; l++)
                {
                    output[3] = letters[l];//add another letter, preserving the previous two
                    output[4] = '\0'; //add a null terminator
                    if (strcmp(crypt(output, salt), hash) == 0) //test the current state of output
                    {
                        return output;
                    }
                }
            }
        }
    }
    return "answer not found"; //return answer not found if no combinatios up to 4 characters long were found
}
//                                      NORMAL PROGRAM ENDS HERE
//                                   enter bellow at your own risk

/*recursive version that I didn't completely finish. The point of making it recursive
is so that you can solve passwords greater than 4 characters (determined by what number you pass with max)

besides the logical errors that is causing the function not to work, I also need the function to check a global boolean
it would be declared outside of the function, and in addition to end case (I think that's what it's called) which is max!=0 of the function
, it would also check to see if the global boolean false, which is turned to false when an answer is found. This allows
one unrelated branch to tell all the other branches to stop making more recurive calls.

for example if the password was just A, which is found pretty much immediately, if there was no boolean, and the function was set to look
up to 4 characters, it would run 9834495 more loops than it needed to.
*/
/*void getPasswordRecursive(string hash, string salt, char letters[], int max, int startStrInt){
    if(max != 0){
        max--;
        int length = 0;
        if(!startStrInt == 0){
            length = snprintf(NULL, 0 , "%d" , startStrInt);
        }
        char startStr[length + 1];
        snprintf(startStr, length +1, "%d", startStrInt);
        startStr[length] = '\0';
        int outputLength = length +2;
        char output[outputLength];
        strcpy(output,startStr);
        for(int i = 0; i < 52; i++){
            output[outputLength- 1] = '\0';
            output[outputLength -2] = letters[i];
            if(strcmp(crypt(output,salt),hash) == 0){
                printf("%s\n", output);
            }
            else{
                startStrInt = atoi(output);
                getPasswordRecursive(hash, salt, letters, max, startStrInt);
            }
        }
    }
}*/


/*psuedocode
make sure the user entered a hash in the command line
assembly an array of possibly characters
do the bruteforce:
    for loop over each character - compare
        for loop over each character - compare
            for loop over each character - compare
                for loop over each character - compare

*/

/*

desired output tests:
$ ./crack 50fkUxYHbnXGw
rofl

andi:50.jPgLzVirkc

*/