Idea
Ad-hoc credentials gathered during an engagement (anonymous FTP success, dumped LSA hashes, kerberoast tickets, default creds verified) currently land in free-text `notes` or `findings.description` — no structure, no search, no "give me every cleartext I've collected on this engagement" view.
A first-class `credentials` table closes the gap and naturally extends the existing KB `default_creds` surface (which is read-only / template-style today).
Proposal
Schema
```
credentials {
id, engagement_id (FK), host_id (FK, nullable), port_id (FK, nullable),
kind: "cleartext" | "ntlm" | "sha1" | "kerberos-tgt" | "kerberos-tgs" | "ssh-key" | "api-token" | "other",
username,
secret, -- the cleartext / hash blob
source: "manual" | "hydra" | "crackmapexec" | "impacket" | "kb-default" | string,
notes,
created_at, updated_at
}
```
CASCADE on engagement / host / port delete — same lifecycle as findings.
UI surfaces
- Per-host pane: a "Credentials" section listing rows scoped to host (host_id) or any port under it
- Engagement-level credentials page: full list with kind / source filter, copy-to-clipboard for secret
- Port detail pane: existing `default_creds` rows from KB land in their own section already; add a "+ verified" affordance that promotes a default-cred row to a real credentials row (`source: kb-default`, kind inferred from cleartext)
- Findings integration: when staging a finding from a credential row, prefill description with the kind + masked secret
Search integration
Extend the global search FTS index (already covers ports / scripts / notes / findings) to include credentials.username + credentials.notes — secret content stays out of FTS to avoid leaking it to the search modal.
Export
The Markdown report should aggregate credentials per host with masked secrets by default (`Th3****`) and a "reveal" toggle in the print stylesheet — operators decide what lands in the deliverable.
Out of scope
- Cracking integration (john / hashcat shell-out) — operators run those externally and import results
- Vault encryption at rest beyond what SQLite already gives — recon-deck stays single-user / single-host
- Cross-engagement credential reuse hints ("you've seen this hash on 3 boxes") — separate "insights" feature
Acceptance
- New migration adds `credentials` table with the columns above
- Per-host "Credentials" pane renders rows with kind badge + copy button
- Engagement settings page or `/engagements/[id]/credentials` lists every cred with filters
- KB `default_creds` surface gains a "+ verified" button that creates a real row
- Markdown report block renders credentials per host (masked by default)
Notes
Ties cleanly to the AD / internal-pentest workflow gap. Naturally extends `KbEntry.default_creds` (already in schema) into a runtime catalog.
Idea
Ad-hoc credentials gathered during an engagement (anonymous FTP success, dumped LSA hashes, kerberoast tickets, default creds verified) currently land in free-text `notes` or `findings.description` — no structure, no search, no "give me every cleartext I've collected on this engagement" view.
A first-class `credentials` table closes the gap and naturally extends the existing KB `default_creds` surface (which is read-only / template-style today).
Proposal
Schema
```
credentials {
id, engagement_id (FK), host_id (FK, nullable), port_id (FK, nullable),
kind: "cleartext" | "ntlm" | "sha1" | "kerberos-tgt" | "kerberos-tgs" | "ssh-key" | "api-token" | "other",
username,
secret, -- the cleartext / hash blob
source: "manual" | "hydra" | "crackmapexec" | "impacket" | "kb-default" | string,
notes,
created_at, updated_at
}
```
CASCADE on engagement / host / port delete — same lifecycle as findings.
UI surfaces
Search integration
Extend the global search FTS index (already covers ports / scripts / notes / findings) to include credentials.username + credentials.notes — secret content stays out of FTS to avoid leaking it to the search modal.
Export
The Markdown report should aggregate credentials per host with masked secrets by default (`Th3****`) and a "reveal" toggle in the print stylesheet — operators decide what lands in the deliverable.
Out of scope
Acceptance
Notes
Ties cleanly to the AD / internal-pentest workflow gap. Naturally extends `KbEntry.default_creds` (already in schema) into a runtime catalog.