Use case
Today, inject contracts that require authentication material (e.g. SMB/NetExec lateral movement, or any injector needing username/password/hash) expose plain text/password ContractFieldType fields. The operator must type the credential value directly into the inject, in clear text, every time with no link to the existing Credentials vault (CredentialSecretReference).
This creates two concrete problems:
- No credential scoping/reuse: the same credential typed once cannot be reused safely across injects/scenarios, it's retyped in clear text each time, increasing exposure and making rotation/audit impossible (no single place to revoke or rotate).
- No compatibility guidance: nothing prevents selecting/typing a credential that is unrelated to what the inject actually needs (e.g. wrong auth method, wrong scope/platform) the operator has no assistance to pick a credential that is actually valid for this specific inject/target.
Current workaround
Operators type credetnials directly as free text into the inject fields at creation time. No connection to the Credentials vault; no reuse, no scoping, no rotation.
Proposed solution
Introduce a new feature "credential" so an inject contract can declare "this field expects a credential of type X " instead of raw text fields. At authoring time, the operator would then:
- See only credentials from the vault that match the expected type/auth-method/scope for that specific inject (instead of free text entry or an unfiltered list).
- Select the matching credential by reference (not by value) the inject stores a
credential_id, not the secret itself
- At execution time, the executor resolves the secret from the vault (via the existing
SecretsProvider/CredentialService path) just-in-time, instead of the value being persisted in clear text in the inject content.
Additional information
Contact MarineLeM / antoinemzs during the Dev brainstorm
Use case
Today, inject contracts that require authentication material (e.g. SMB/NetExec lateral movement, or any injector needing username/password/hash) expose plain
text/passwordContractFieldTypefields. The operator must type the credential value directly into the inject, in clear text, every time with no link to the existing Credentials vault (CredentialSecretReference).This creates two concrete problems:
Current workaround
Operators type credetnials directly as free text into the inject fields at creation time. No connection to the Credentials vault; no reuse, no scoping, no rotation.
Proposed solution
Introduce a new feature "credential" so an inject contract can declare "this field expects a credential of type X " instead of raw text fields. At authoring time, the operator would then:
credential_id, not the secret itselfSecretsProvider/CredentialServicepath) just-in-time, instead of the value being persisted in clear text in the inject content.Additional information
Contact MarineLeM / antoinemzs during the Dev brainstorm