Visit EliteSys, home of Entry Pro
This program is designed and intended specifically for legal security testing purposes.
Do not use this program to gain illegal access to any computer or information.
Do not use this program to stage an illegal attack on any computer or online system.
For more detail, please read the rest of this manual.
Because the majority of Internet sites have very poor password assignment policies, they can easily be compromised by a brute-force attack. Administrators, or any other privileged users, should use this program to determine if their account/system is truly robust and secure.
Creating a good wordlist
For the majority of sites, a wordlist attack will be faster and more successful than a generator attack. The construction of a good wordlist, therefore, is very important.
A effective wordlist contains keywords which are relevant to the site and its users. For example, if you are making an attack against the Chicago Sentinel Online, you should add chicago, sentinel, online, press, news, extra, scoop, etc., to a basic list of names and other common passwords. An effective list contains AT LEAST fifty words, and may contain hundreds or even thousands.
For lists of names and other common words, visit the EliteSys Wordlist Library at http://web.idirect.com/~elitesys/lists.html.
Setting attack options
Entry has a number of configurable settings, to allow customization of any attack.
Automatically save progress after every X attempts
If this option is checked, Entry will perform a Lazy Save after every X attempts.
If you have not already chosen a name for the current session file, Autosave.eaf will be used.
Give up after X attempts
If this option is unchecked, Entry will make the maximum possible number of attempts before stopping the attack (approximately 2.1 billion).
Autmatically skip words over/under X characters
If these options are checked, Entry will filter all wordlist-supplied words by length automatically while in online mode.
Maintain log of cracked sites
If this option is checked, all working username/password combinations will be recorded in a log file in the program directory, entrylog.html. This log file may be viewed by any web browser software.
Click here to see a sample log file.
Launch browser after finding a good username and password
If this option is checked, any cracked FTP site or HTTP document will automatically be loaded in your default web browser.
Don't stop after the first good username and password
If this option is unchecked, Entry will automatically go offline if a working username/password combination is found.
If this option is checked, Entry will write any working username/password combinations to the log file, and continue the attack until all possible attempts have been made.
Agent Name
Most web browsers use an "agent" name to identify themselves to HTTP servers. Entry will use the contents of this field as its agent name.
The default Agent name for Entry is EliteSys Entry/2.0 (Win32).
Preparing an online attack
To prepare an online attack, select File...New from Entry's drop-down menu and enter the necessary information:
Title
This title will appear on Entry's session status display. If you do not enter anything in this box, a default title will be displayed.
URL
Type the secure HTTP or FTP address, or POP3 server, in this box. Here are some examples of good Entry URLs:
Username, Password Source
There are four choices for a username/password source:
Request Method
Entry can request a HTTP document in one of two ways: GET or HEAD. A GET request will attempt to retrieve the entire protected document, while a HEAD request will only attempt to retrieve the document's header information (description).
Using the HEAD method may cause Entry to run slightly faster, as less bandwidth will be used. However, some web servers are configured to ignore authentication via HEAD; in those cases, GET should be chosen.
This setting is ignored for FTP sites and POP3 mailboxes.
Character Sets
If you choose to have usernames and/or passwords supplied by the generator, you must check at least
one of these boxes. The generator will use all characters in the selected set(s) to generate possible usernames and/or passwords.
Wordlist format
If you choose to have usernames and/or passwords supplied by a wordlist, you must also input that wordlist's format. There are three different wordlist formats supported by Entry:
Distributed Attack
Both Entry Pro and Entry LE can use distributed attack status files. For security reasons, only Entry Pro users may initiate a distributed attack.
If you intend to create distributed attack status files for use on multiple computers, we recommend that you give relative file names for any wordlists you use, i.e. wordlist.txt instead of C:\Program Files\EntryLE\wordlist.txt. This will prevent a possible Wordlist not found error on those other computers.
This option can split an attack into up to 99 segments, any of which may take place on a different machine. Running simultaneous attacks on this fashion can be substantially faster, and may provide a more accurate test of your system's robustness. You specify the number of attackers, the session file output directory, and the session file name.
For example, if you enter...
...these session files will be created...
If files with those names already exist, they will be overwritten.Using a HTTP proxy server
A HTTP proxy acts as a go-between for your computer and the HTTP server. You ask it to retrieve a page from a website on your behalf; the proxy passes the page along to you, (usually) without modification. We recommend you do not enable this option unless you absolutely need to, as it can slow down program operation.
During an attack, Entry will automatically enter offline mode if:
Status
This message shows the current status of your attack session.
Tried
The number of unsuccessful login attempts made during this session is shown here.
Skipped
The number of login attempts skipped during this session is shown here.
Progress Bar
This bar shows the percentage of attack completion. When it becomes totally blue, all username/password combinations have been tried.
The progress bar is inactive during a Distributed Attack.
Username, Password
The next username/password combination to be tried is shown here.
Skip Word
This button is disabled if the Static or Copy Password from Username options were chosen during the preparation of the attack, or if Entry is in Online mode.
Fast Forward to...
This button is disabled if the Static or Copy Password from Username options were chosen during the preparation of the attack, or if Entry is in Online mode.
Pressing this button will skip over the next username or password.
Pressing this button will skip over usernames or passwords until the target word is found.
Pressing this button will open the source wordlist for viewing, in its associated text editor or word processor (usually Windows Notepad).
This button is disabled if the Static, Generator or Copy Password from Username options were chosen during the preparation of the attack.
Online Button
Pressing this button will cause Entry to enter online (attack) mode. If this button is depressed, pressing it again will cause Entry to leave online mode.
This button is disabled if all username/password combinations have been tried, or there is a session initialization error.
Lazy Save Button
If you have not already chosen a name for the current session file, autosave.eaf will be used.
This button is disabled while Entry is in offline mode. To save while in offline mode, select File...Save from Entry's drop-down menu.
Pressing this button will cause Entry to save the status of the current session, without going offline. It will remain depressed until the current login attempt is completed and the save has been made.
Pressing this button at any time will terminate Entry immediately, without saving the status of the session in progress.
Form-based authentication schemes (such as Adult Check) are not considered secure under this definition.
If your password assignment policy allows for hundreds of billions of combinations, you may not need to test your system security in this manner, as the probability of finding a random working password is very small.
For more information, contact EliteSys.