Documentation
¶
Overview ¶
Package credkit holds the credential-use primitives for authorized security testing: verifying that a discovered credential actually works. It is the "use the credential" layer, not the "find the vulnerability" layer.
Three probes:
- cloud AK/SK minimal-read verification (ali/tencent/aws/huawei/volc STS)
- database live-auth verification (postgres/redis, raw protocols)
- SSH live-auth verification (x/crypto/ssh, read-only id + sudo -n probe)
All probes are read-only: they authenticate and read identity/permission surface, never performing any write or privileged mutation. A host wires the cloud probe with a Fetcher so scope/rate/audit policy still applies; db/ssh probes are direct TCP/SSH and rely on the host's target authorization gate.
db.go implements read-only database credential verification: postgres via the pgx driver plus minimal read queries, redis via the raw RESP protocol (no driver dependency). mysql/mongodb/elasticsearch are not supported and return an explicit error rather than a fake success.
ssh.go implements read-only SSH credential verification: authenticate with x/crypto/ssh, then run id and sudo -n true to probe the permission surface (login / groups / passwordless sudo). No write operation is performed.
Index ¶
- Constants
- Variables
- func CloudEndpoints() map[string]string
- func DefaultDBPort(typ string) int
- func LooksLikePlaceholder(s string) bool
- func MaskKey(key string) string
- func NewCapability(deps capkit.Deps) (capkit.Capability, error)
- func ValidProvider(p string) bool
- type DBProbeInput
- type DBProbeResult
- type Kit
- type SSHProbeInput
- type SSHProbeResult
- type VerifyResult
Constants ¶
const ( ProviderAliyun = "aliyun" ProviderTencent = "tencent" ProviderAWS = "aws" ProviderHuawei = "huawei" ProviderVolc = "volc" )
Cloud providers supported by AK/SK verification.
const ( StatusValid = "valid" StatusInvalid = "invalid" // key explicitly rejected by vendor StatusRestricted = "restricted" // key exists but policy-blocked (key is real) StatusUnverifiable = "unverifiable" // network/service reason, no conclusion )
Verification status semantics (four tiers, aligned with miniapp/llm verifiers).
Variables ¶
var ErrNotFound = errors.New("cloud key 不存在")
ErrNotFound is returned when a single record does not exist.
var Providers = []string{ProviderAliyun, ProviderTencent, ProviderAWS, ProviderHuawei, ProviderVolc}
Providers is shared by frontends and backends.
Functions ¶
func CloudEndpoints ¶
CloudEndpoints returns the default vendor STS/IAM endpoints.
func DefaultDBPort ¶
DefaultDBPort returns the default port for a database type.
func LooksLikePlaceholder ¶
LooksLikePlaceholder rejects obvious placeholder values for credential entry.
func NewCapability ¶
func NewCapability(deps capkit.Deps) (capkit.Capability, error)
NewCapability is the registry constructor: it satisfies capkit.Spec.New.
func ValidProvider ¶
Types ¶
type DBProbeInput ¶
type DBProbeInput struct {
Type string // postgres | redis(mysql/mongodb/elasticsearch unsupported)
Host string
Port int // 0 = default port
Username string
Password string
Database string // postgres optional
Timeout time.Duration
}
DBProbeInput is one database credential verification request.
type DBProbeResult ¶
type DBProbeResult struct {
Alive bool `json:"alive"`
Authed bool `json:"authed"` // redis: AUTH result
User string `json:"user"` // current user (postgres)
Version string `json:"version"` // server version
Database string `json:"database"` // connected database
Detail string `json:"detail"` // human-readable conclusion
}
DBProbeResult is the live-connection conclusion: liveness + permission surface.
func VerifyDB ¶
func VerifyDB(ctx context.Context, in DBProbeInput) (*DBProbeResult, error)
VerifyDB performs live verification. Invalid credentials / unreachable network return an explicit Detail, never a fake success.
type Kit ¶
type Kit struct {
Fetcher capkit.Fetcher
// Endpoints optionally overrides vendor STS/IAM endpoints per provider
// (e.g. a sovereign-cloud host). Empty values fall back to CloudEndpoints.
Endpoints map[string]string
}
Kit holds the injected ports for credential-use verification.
func New ¶
New builds a credential kit. The host injects a Fetcher so cloud verification still respects proxy/timeout/rate/audit policy.
func (*Kit) Call ¶
Call is the envelope shell: every return path from dispatch is normalized so Status/OK/Meta and a clamped Summary hold on success and failure alike.
func (*Kit) Manifest ¶
Manifest exposes the credential-use tool surface. These tools verify that a discovered credential works; they do not discover vulnerabilities.
func (*Kit) Verify ¶
func (k *Kit) Verify(ctx context.Context, provider, accessKeyID, secretKey string) (VerifyResult, error)
Verify does a minimal-read check of one AK/SK pair via the provider STS GetCallerIdentity-style endpoint. The kit's Fetcher is used, so the host still applies proxy/timeout/rate/audit policy. Endpoints can be overridden per provider (e.g. a sovereign-cloud STS host) via Kit.Endpoints.
type SSHProbeInput ¶
type SSHProbeInput struct {
Host string
Port int // 0 = 22
Username string
Password string // either this or Key
PrivateKey string // PEM private key (optional)
Timeout time.Duration
}
SSHProbeInput is one SSH credential verification request.
type SSHProbeResult ¶
type SSHProbeResult struct {
Alive bool `json:"alive"` // TCP/SSH banner reachable
Authed bool `json:"authed"` // credential accepted
User string `json:"user"` // id -un after login
Groups string `json:"groups"` // id output summary
SudoNOPW bool `json:"sudo_nopw"` // sudo -n true succeeded (high risk)
Banner string `json:"banner,omitempty"`
Detail string `json:"detail"`
}
SSHProbeResult is the live-connection conclusion: liveness + auth + surface.
func VerifySSH ¶
func VerifySSH(ctx context.Context, in SSHProbeInput) (*SSHProbeResult, error)
VerifySSH performs live verification. Invalid credentials / unreachable network return an explicit Detail.
type VerifyResult ¶
type VerifyResult struct {
Valid bool `json:"valid"`
Status string `json:"status"`
AccountID string `json:"account_id,omitempty"`
Arn string `json:"arn,omitempty"`
Code string `json:"code,omitempty"`
Message string `json:"message,omitempty"`
}
VerifyResult is the conclusion of one STS verification.
Source Files