credential

package
v0.3.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 21, 2026 License: GPL-3.0 Imports: 25 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

View Source 
var DisplayFields = map[string]func(c *credential.Core) string{
	"ID": func(c *credential.Core) string {

		if c.GetPrivate() != nil {
			return color.HiGreenString(display.FormatSmallID(c.Id))
		}
		return display.FormatSmallID(c.Id)
	},
	"Public":  func(c *credential.Core) string { return publicLabel(c) },
	"Private": func(c *credential.Core) string { return privateLabel(c) },
	"Realm":   func(c *credential.Core) string { return realmLabel(c.GetRealm()) },
	"Type":    func(c *credential.Core) string { return typeLabel(c) },
	"Logins": func(c *credential.Core) string {
		if n := c.GetLoginsCount(); n > 0 {
			return fmt.Sprint(n)
		}
		return ""
	},
	"Origin":     func(c *credential.Core) string { return originLabel(primarySource(c)) },
	"Session":    func(c *credential.Core) string { return primarySource(c).GetSessionId() },
	"Discovered": func(c *credential.Core) string { return fmtTime(c.GetCreatedAt()) },
	"Updated":    func(c *credential.Core) string { return fmtTime(c.GetUpdatedAt()) },
}

DisplayFields maps column names to per-credential value generators. This is the single source of truth feeding the table, the `info` detail view, and completions.

View Source 
var Reveal bool

Reveal controls whether Private secrets are printed in clear text. It is off by default (list views mask secrets); the CLI flips it on for `info` / when `--reveal` is passed.

Functions

func AbsorbsPartial 

func AbsorbsPartial(full, partial *credential.CoreORM) bool

AbsorbsPartial reports whether inserting `full` should collapse the existing `partial` Public-only Core: same Public, `full` adds a Private or Realm, and the partial carries no Logins of its own worth preserving (LoginsCount == 0). This keeps the username list clean (no "admin" bare + "admin" with-password pair) without ever silently dropping provenance.

func AreCredentialsIdentical 

func AreCredentialsIdentical(a, b *credential.CoreORM) bool

AreCredentialsIdentical reports whether two Cores denote the same credential (same triple). A Core with no identity-bearing component at all ("||") is malformed (the model requires at least one of public/private/realm) and is never considered identical to anything.

func Completions 

func Completions() []display.Options

Completions returns the columns combined into completion candidates and their descriptions. Whichever column is chosen as the candidate (via WithCandidateValue) is inserted; the remaining columns form the aligned description shown next to it — so a user completing an opaque ID still sees who/what/where it is.

func CoreIdentity 

func CoreIdentity(c *credential.CoreORM) string

CoreIdentity is the value-based identity of a Core: the (public, private, realm) triple. Any component may be empty. Two Cores with the same non-empty identity are the same credential, so re-importing the exact same combination enriches the existing row rather than duplicating it.

func Detail 

func Detail(c *credential.Core, all []*credential.Core) display.Detail

Detail assembles the full `info` view for a single credential: the identity banner, the side-by-side info panes, and the derived insights (which need the whole set `all` to compute secret reuse). It hands these to the shared display.Detail renderer, so a credential's detail view is laid out identically to every other domain's.

func DisplayDetails 

func DisplayDetails() []display.Options

DisplayDetails returns the weighted headers for a single-credential `info` view. Weight groups become blank-line-separated sections (Identity / Provenance / Classification / Timestamps).

func DisplayHeaders 

func DisplayHeaders() []display.Options

DisplayHeaders returns the weighted table headers for a list of credentials.

func ForHost 

func ForHost(h *host.Host)

ForHost - Finds all credential.Logins associated with a Host.

func ForHostsAndServices 

func ForHostsAndServices(hosts []*host.Host, services ...[]*network.Service)

ForHostsAndServices - Finds all credential.Logins that are associated with a list of hosts and/or services.

func InfoPanes 

func InfoPanes(c *credential.Core) []display.Pane

InfoPanes returns the credential's detail grouped into titled panes, for side-by-side layout via display.Columns. The grouping mirrors the Details weight-sections (Identity / Provenance / Classification) but renders them as columns that pack to the terminal width.

func Insights 

func Insights(target *credential.Core, all []*credential.Core) (lines []string)

Insights returns the cross-set observations for a single credential (see CREDENTIALS.md §5): secret reuse, replayability, cracked-from lineage, and validation. `all` is the full set the credential is being viewed within (reuse cannot be computed from one credential alone).

func InvalidateLogin 

func InvalidateLogin(opts *LoginOptions) (err error)

InvalidateLogin - Checks to see if a credential.Login exists for a given set of details. If it does exists, we then appropriately set the status to one of our failure statuses.

@param: The template that you pass as argument must be populated with several fields, 

each of them in turn checking some of its own required fields. Please refer
to the InvalidateLoginOpts documentation for a list of each of those required.

Raises an error if any of the above options are missing

func MergeCore 

func MergeCore(dst, src *credential.CoreORM) (changed bool)

MergeCore folds `src` into `dst` in place using the four field-classes (see CREDENTIALS.md §3):

  • Identity fields (Public.Type/Username, Private.Type/Data, Realm.Key/Value) are left untouched — by definition they are equal when two Cores match, and changing them would mean a different credential.
  • Enrichment fields (Public.Claims/Data, Private.JTRFormat) are fill-only: a known value is never clobbered by an empty one, but an empty value is filled from src.
  • Provenance (Sources) is UNION, not first-wins: every contributing tool a matched Core has been seen from is accumulated, so a second tool enriching a known credential adds its Source rather than being dropped (the former single Origin was first-wins).
  • LoginsCount is derived from the Logins table and never taken from the wire.

It returns true if dst was actually changed, so callers can skip a no-op write.

func NewLogin 

func NewLogin(core *Core, opts *LoginOptions) (*Core, *Login, error)

NewLogin - This method is responsible for creating a credential.Login object which ties a credential.Core to the .Service in the LoginOptions, it is a valid credential for.

func WhereLoggedInHost 

func WhereLoggedInHost(h *host.Host) func(*gorm.DB) *gorm.DB

WhereLoggedInHost scopes a Core query to those whose provenance was gathered from a service running on the given host (its origin service belongs to the host).

NOTE: exact login tracking — the credential.Login use of a Core against a specific service — awaits a Core<->Login foreign key in the schema (Core.Logins is commented out and the generated LoginORM carries no core_id). Until then this approximates "logged into this host" through the service-scoped provenance the model does record.

func WhereOriginIs 

func WhereOriginIs(o *provenance.Source) func(*gorm.DB) *gorm.DB

WhereOriginIs scopes a Core query to those whose provenance includes the given source (the former credential.Origin, now the shared provenance.Source). When o carries an Id it matches that exact source row; otherwise it matches by the source's identity tuple (tool/type/ session/filename/cracker/service). The join runs through the core_sources m2m table.

func WhereOriginServiceForHost 

func WhereOriginServiceForHost(h *host.Host) func(*gorm.DB) *gorm.DB

WhereOriginServiceForHost scopes a Core query to those with a Service-type origin gathered from a service on the given host (the former OriginType_Service).

func WhereOriginSessionForHost 

func WhereOriginSessionForHost(h *host.Host) func(*gorm.DB) *gorm.DB

WhereOriginSessionForHost scopes a Core query to those with a session/C2 origin gathered on the given host. The former OriginType_Session maps onto the c2/session producer (SourceType_C2) in the unified provenance model, scoped to the host's services.

Types

type BlankPassword 

type BlankPassword Private

BlankPassword - A credential.Private password. Note that upon saving this object in DB, any .Data value will be replaced by an empty string.

func NewBlankPassword 

func NewBlankPassword() *BlankPassword

NewBlankPassword - Create a new blank Password Credential.

func (*BlankPassword) ToORM 

func (p *BlankPassword) ToORM(ctx context.Context) (credential.PrivateORM, error)

ToORM - Get the SQL object for the BlankPassword credential. NOTE: A blank password is considered invalid if BOTH 1) the BlankPassword.Type is not set to credential.PrivateType_BlankBlankPassword and 2) the BlankPassword.Data is "". This will throw a validation error when saving the password to DB. If you want to save an empty password, you MUST change the .Type to PrivateType_BlankBlankPassword.

func (*BlankPassword) ToPB 

func (p *BlankPassword) ToPB() *credential.Private

ToPB - Get the Protobuf object for the BlankPassword credential.

type BlankUsername 

type BlankUsername Public

BlankUsername - A public credential in the form of a Username. Note that upon saving this object in DB, any .Username value will be replaced by an empty string.

func NewBlankUsername 

func NewBlankUsername() *BlankUsername

NewBlankUsername - Create a new BlankUsername Public credential. Using this type ensures that its .Username field is nil when saved.

func (*BlankUsername) ToORM 

func (u *BlankUsername) ToORM(ctx context.Context) (credential.PublicORM, error)

ToORM - Get the SQL object for the BlankUsername credential.

func (*BlankUsername) ToPB 

func (u *BlankUsername) ToPB() *credential.Public

ToPB - Get the Protobuf object for the BlankUsername credential.

type Certificate 

type Certificate Public

Certificate - An x509 Certificate potentially containing a public key and any root certificates, as well as various details pertaining to them.

func (*Certificate) AsX509 

func (p *Certificate) AsX509() *x509.Certificate

AsX509 - Returns the Certificate as a Go native x509 certificate.

func (*Certificate) ToORM 

func (p *Certificate) ToORM(ctx context.Context) (credential.PublicORM, error)

ToORM - Get the SQL object for the Certificate credential.

func (*Certificate) ToPB 

func (p *Certificate) ToPB() *credential.Public

ToPB - Get the Protobuf object for the Certificate credential.

type Core 

type Core credential.Core

Core - A wrapper around the credential.Core protobuf type. This is unexported because the core is always only a driver that orchestrates one or more Credential types, along with an optional realm. Various functions in the package allow users to instantiate Credential sets, similarly to Metasploit Credential API.

func NewCore 

func NewCore(opts *CreateOptions) (*Core, error)

NewCore - Create a credential.Core, and all the sub-objects that it depends upon. Some assertions might be made in this function, but they are kept to the bare minimum, and the purpose of the Options parameter is to make callers able to prepare their call in more detail.

type CreateOptions 

type CreateOptions struct {
	// Public - The credential.Public that we tried.
	// .Username  - if PublicType_Username  (required)
	// .Key,      - if PublicType_Key       (required)
	Public Public

	// Private - The credential.Private that we tried.
	// .Data    - checked against the .PrivateType (required)
	Private Private

	// Sources - The provenance of the credentials that we are submitting for creation (the
	// former Origin, now the shared provenance.Source): the contributing tool, type, and any
	// ports, services, filenames the SourceType calls for. A creation usually carries one,
	// but the field is a slice because a credential can accrue contributions from many tools.
	Sources []*provenance.Source

	// Realm - The credential realm to which the Public/Private belong.
	Realm credential.Realm
}

CreateOptions - A template holding the objects (either optional or required depending on the context) that can be passed as parameter to functions creating either credential.Cores, Logins, pairs, etc. Each of these functions generally describes the fields that matter to it, and each of the types have their own fields' documentation.

Generally, it is advised to slowly construct and populate such a type, taking care of each considered field one at a time, and when everything is set, submit this struct to one of the CreateCredential...() functions.

type Login 

type Login credential.Login

Login - The use of a credential.Core against a service.

This type, like some other types in the user-facing AIMS API, offers some database filtering functions (which are no more than reexported & populated SQL where clauses) to get one or more Logins for a given context (a host, a service, one or more origins, etc)

You can also, like all the other types, get the ORM-compliant object with ToORM(), and then construct your own database filtering clauses.

func NewCoreAndLogin 

func NewCoreAndLogin(opts *CreateOptions, loginOpts *LoginOptions) (*Login, error)

NewCoreAndLogin - Create a credential.Core and its associated credential.Login. This, in effect, ties the Core with a Service passed in the options (required), through the created Login type. NOTE: Public and Private types used are those of LoginOpts, NOT CreateOptions.

func (*Login) FailedLoginsByUsername 

func (l *Login) FailedLoginsByUsername(h *host.Host)

FailedLoginsByUsername - Each username that is related to a credential.Login on the passed host, and for each username, the logins of particular statuses that are related to that username as credential.Public, ordered by the login last attempt date.

func (*Login) ToORM 

func (l *Login) ToORM(ctx context.Context) (credential.LoginORM, error)

ToORM - Get the SQL object for the credential Login.

func (*Login) ToPB 

func (l *Login) ToPB() *credential.Login

ToPB - Get the Protobuf object for the credential Login.

type LoginOptions 

type LoginOptions struct {

	// Service - The service against which a Login has been performed.
	// Fields that are checked:
	// .Hostname  - an IP or a domain name, that you can populate.
	// .Protocol  - The transport and/or application protocol of the service
	Service network.Service

	// Public - The credential.Public that we tried.
	// Fields that are checked:
	// .Username  - if PublicType_Username
	// .Key,      - if PublicType_Key
	Public Public

	// Private - The credential.Private that we tried.
	// Fields that are checked:
	// .Data    - checked against the .PrivateType
	Private Private

	// Status - The status symbol that the user
	// gives when populating this template.
	Status credential.LoginStatus
}

LoginOptions - A template used as a parameter to functions creating/updating/ invalidating logins. None of these fields are nil by default, but some of their own values are checked in the InvalidateLogin() function. Each field in this struct list its fields checked by InvalidateLogin(). NOTE: At no point any ID will be required from any of those types, so this function does NOT require any database-existing object.

type NTLMHash 

type NTLMHash Private

NTLMHash - A credential.Private password hash that can be credential.ReplayableHash replayed to authenticate to SMB. It is composed of two hash hex digests (where the hash bytes are printed as a hexadecimal string where 2 characters represent a byte of the original hash with the high nibble first): (1) {lanManagerHexDigestRegexp, the LAN Manager hash's hex digest} and (2) {ntLanManagerHexDigestRegexp, the NTLM hash's hex digest}. NOTE: Please instantiate a new NTLMHash with NewNTLMHash().

func NewNTLMHash 

func NewNTLMHash(hash []byte) *NTLMHash

NewNTLMHash - Create a new NTLM hash Credential.

func (*NTLMHash) HexDigest 

func (h *NTLMHash) HexDigest(hash []byte) (digest string)

HexDigest - Converts a buffer containing `hash` bytes to a String containing the hex digest of that `hash`. @param hash [String] a buffer of bytes @return [String] a string where every 2 hexadecimal characters represents a byte in the original hash buffer.

func (*NTLMHash) LMHexDigestFromPassword 

func (h *NTLMHash) LMHexDigestFromPassword(password string) (digest string)

LMHexDigestFromPassword - Converts a Private.Data to an LanManager Hash hex digest. Handles passwords over the LanManager limit of 14 characters by treating them as ” for the LanManager Hash calculation.

@param password_data the plain text password @return a 32 character hexadecimal string

func (*NTLMHash) NTLMHexDigestFromPassword 

func (h *NTLMHash) NTLMHexDigestFromPassword(password string) (digest string)

NTLMHexDigestFromPassword - Converts a Private.Password.Data to a NTLM Hash hex digest. 

@param password_data the plain text password
@return a 32 character hexadecimal string

func (*NTLMHash) ToPB 

func (h *NTLMHash) ToPB() *credential.Private

ToPB - Get the Protobuf object for the NTLMHash credential.

type NonReplayableHash 

type NonReplayableHash PasswordHash

NonReplayableHash - A credential.PasswordHash password hash that cannot be replayed to authenticate to other services. Contrasts with credential.ReplayableHash. The NonReplayableHash.Data is any password hash, such as those recovered from `/etc/passwd` or `/etc/shadow`.

func NewNonReplayableHash 

func NewNonReplayableHash(hash []byte) *NonReplayableHash

NewNonReplayableHash - Create a new NonReplayableHash Credential.

func (*NonReplayableHash) ToORM 

func (h *NonReplayableHash) ToORM(ctx context.Context) (credential.PrivateORM, error)

ToORM - Get the SQL object for the NonReplayableHash credential.

func (*NonReplayableHash) ToPB 

func (h *NonReplayableHash) ToPB() *credential.Private

ToPB - Get the Protobuf object for the NonReplayableHash credential.

type Password 

type Password Private

Password - A credential.Private password. NOTE: A blank password is considered invalid if BOTH 1) the Password.Type is not set to credential.PrivateType_BlankPassword and 2) the Password.Data is "". This will throw a validation error when saving the password to DB. If you want to save an empty password, you MUST change the .Type to PrivateType_BlankPassword. NOTE: Please instantiate a new Password with NewPassword().

func NewPassword 

func NewPassword(data string) *Password

NewPassword - Create a new Password Credential.

func (*Password) ToORM 

func (p *Password) ToORM(ctx context.Context) (credential.PrivateORM, error)

ToORM - Get the SQL object for the Password credential. NOTE: A blank password is considered invalid if BOTH 1) the Password.Type is not set to credential.PrivateType_BlankPassword and 2) the Password.Data is "". This will throw a validation error when saving the password to DB. If you want to save an empty password, you MUST change the .Type to PrivateType_BlankPassword.

func (*Password) ToPB 

func (p *Password) ToPB() *credential.Private

ToPB - Get the Protobuf object for the Password credential.

type PasswordHash 

type PasswordHash Private

PasswordHash - The cryptographic hash of a credential.Password password}. Like some other private.Credential types, the PasswordHash.Data cannot be nil.

func NewPasswordHash 

func NewPasswordHash(hash []byte) *PasswordHash

NewPasswordHash - Create a new PasswordHash Credential. Its .Type attribute is set to PrivateType_NonReplayableHash by default, so when you know that is not the case, do not forget to change it if needed.

func (*PasswordHash) ToORM 

func (h *PasswordHash) ToORM(ctx context.Context) (credential.PrivateORM, error)

ToORM - Get the SQL object for the PasswordHash credential.

func (*PasswordHash) ToPB 

func (h *PasswordHash) ToPB() *credential.Private

ToPB - Get the Protobuf object for the PasswordHash credential.

type PostgresMD5 

type PostgresMD5 NonReplayableHash

PostgresMD5 - A credential.Private.PasswordHash password hash that can be credential.Private.ReplayableHash replayed to authenticate to PostgreSQL servers. It is composed of a hexadecimal string of 32 characters prepended by the string 'md5' NOTE: Please instantiate a new PostgresMD5 with NewPostgresMD5().

func NewPostgresMD5 

func NewPostgresMD5(hash []byte) *PostgresMD5

NewPostgresMD5 - Create a new PostgreSQL MD5 Credential and its embedded Protobuf type.

func (*PostgresMD5) ToORM 

func (p *PostgresMD5) ToORM(ctx context.Context) (credential.PrivateORM, error)

ToORM - Get the SQL object for the PostgresMD5 credential.

func (*PostgresMD5) ToPB 

func (p *PostgresMD5) ToPB() *credential.Private

ToPB - Get the Protobuf object for the PostgresMD5 credential.

type Private 

type Private credential.Private

Private - Base type for all private credentials. A private credential is any credential that should not be publicly disclosed, such as a credential.Private.Password password, password hash, or key file. NOTE: By default, a credential.Private is of Type Password, and any blank Private.Data field value will be treated as incorrect.

func (*Private) ToORM 

func (p *Private) ToORM(ctx context.Context) (credential.PrivateORM, error)

ToORM - Get the SQL object for the Private credential.

func (*Private) ToPB 

func (p *Private) ToPB() *credential.Private

ToPB - Get the Protobuf object for the Private credential.

type PrivateKey 

type PrivateKey Private

PrivateKey - The Private part of a cryptographic key. All private key types in AIMS are derived from this type, but the base type offers some methods allowing to get the key type, cyphers, algorithms and other info about it.

func NewPrivateKeyFromBytes 

func NewPrivateKeyFromBytes(data []byte) *PrivateKey

NewPrivateKeyFromBytes - Creates a new Private key from bytes data.

func (*PrivateKey) Algorithm 

func (p *PrivateKey) Algorithm() x509.PublicKeyAlgorithm

Algorithm - Gives the cipher algorithm for the Private key

func (*PrivateKey) AsCertificate 

func (p *PrivateKey) AsCertificate() *x509.Certificate

AsCertificate - Returns the Private key parsed into a Certificate. Note that this will automatically return you a Certificate filed

func (*PrivateKey) Fingerprint 

func (p *PrivateKey) Fingerprint() (fingerprint string)

Fingerprint - The private returns its base64-encoded, md5-hashed fingerprint. MD5 is used because this function is not meant to be used in networking code.

func (*PrivateKey) ToORM 

func (p *PrivateKey) ToORM(ctx context.Context) (credential.PrivateORM, error)

ToORM - Get the SQL object for the PrivateKey credential.

func (*PrivateKey) ToPB 

func (p *PrivateKey) ToPB() *credential.Private

ToPB - Get the Protobuf object for the PrivateKey credential.

type Public 

type Public credential.Public

Public - A Publicly disclosed credential, like a username or a public key. NOTE: By default, a credential.Public is of Type Username, and any blank Public.Username field value will be treated as incorrect.

func (*Public) ToORM 

func (p *Public) ToORM(ctx context.Context) (credential.PublicORM, error)

ToORM - Get the SQL object for the Public credential.

func (*Public) ToPB 

func (p *Public) ToPB() *credential.Public

ToPB - Get the Protobuf object for the Public credential.

type PublicKey 

type PublicKey Public

PublicKey - The Public part of a cryptographic key. All public key types in AIMS are derived from this type, but the base type offers some methods allowing to get the key type, cyphers, algorithms and other info about it. As well, a credential.PublicKey can be used to produce Certificates, which - as a reminder - are not keys but public.Credentials *containing* a key.

func NewPublicKeyFromBytes 

func NewPublicKeyFromBytes(data []byte) *PublicKey

NewPublicKeyFromBytes - Creates a new Public key from bytes data.

func (*PublicKey) Algorithm 

func (p *PublicKey) Algorithm() x509.PublicKeyAlgorithm

Algorithm - Gives the cipher algorithm for the Public key

func (*PublicKey) AsCertificate 

func (p *PublicKey) AsCertificate() *x509.Certificate

AsCertificate - Returns the Public key parsed into a Certificate, which might help for any use in native networking code, or even for additional usage/printing of the information embedded in the key.

func (*PublicKey) Fingerprint 

func (p *PublicKey) Fingerprint() string

Fingerprint - The public returns its base64-encoded, md5-hashed fingerprint. MD5 is used because this function is not meant to be used in networking code.

func (*PublicKey) ToORM 

func (p *PublicKey) ToORM(ctx context.Context) (credential.PublicORM, error)

ToORM - Get the SQL object for the PublicKey credential.

func (*PublicKey) ToPB 

func (p *PublicKey) ToPB() *credential.Public

ToPB - Get the Protobuf object for the PublicKey credential.

type ReplayableHash 

type ReplayableHash PasswordHash

ReplayableHash - A credential.PasswordHash password hash that can be replayed to authenticate to additional services.

func NewReplayableHash 

func NewReplayableHash(hash []byte) *ReplayableHash

NewReplayableHash - Create a new ReplayableHash Credential.

func (*ReplayableHash) ToORM 

func (h *ReplayableHash) ToORM(ctx context.Context) (credential.PrivateORM, error)

ToORM - Get the SQL object for the ReplayableHash credential.

func (*ReplayableHash) ToPB 

func (h *ReplayableHash) ToPB() *credential.Private

ToPB - Get the Protobuf object for the ReplayableHash credential.

type Username 

type Username Public

Username - A public credential in the form of a Username .

func NewUsername 

func NewUsername(user string) *Username

NewUsername - Create a new Username Public credential. Using this type ensures that its .Username field is not nil when saved into DB by default.

func (*Username) ToORM 

func (h *Username) ToORM(ctx context.Context) (credential.PublicORM, error)

ToORM - Get the SQL object for the Username credential.

func (*Username) ToPB 

func (h *Username) ToPB() *credential.Public

ToPB - Get the Protobuf object for the Username credential.

Source Files

View all Source files

Directories

Path Synopsis
pb
rpc

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.