CSG: Credential Storage for CTFs/Pentests

Simplified Credential Management From the Terminal

Hello, World! I recently finished writing the first version of a tool I called csg which is short for “Credential Storage with Go”. csg allows you to centralize the storage of credentials you obtain during your CTFs/Pentests so that they are quicker to access and manage. In this article, I’ll do a quick demo of how to install csg and also provide some usage examples. If you end up using the tool and find an issue, please submit an issue here.

Setup

In this section, I’ll demonstrate the installation of csg and also show you how to add auto-completion to Bash to make using csg easier. Let’s install csg.

Installation

1. With Go Installed

Note: The following command will install csg to $HOME/go/bin so make sure this folder is in your $PATH environment variable. Run

echo 'export PATH=$PATH:$HOME/go/bin/' >> ~/.bashrc && source ~/.bashrc

to add this folder to your path. Then install csg with the following command:

go install github.com/bin3xish477/csg@latest

1. From Release Page

wget https://github.com/bin3xish477/csg/releases/download/v1.0/csg-linux-amd64.tar.gz
tar zxvf csg-linux-amd64.tar.gz 
sudo install csg /usr/local/bin/

3. From Source (requires Go to be installed)

git clone https://github.com/bin3xish477/csg.git
cd csg
go install

To confirm you have csg installed, run csg --help . You should the following help menu:

Setting Up Auto-Completion for CSG

To get Bash auto-completion, run the following command on the respective OS.

Linux: csg completion bash > /etc/bash_completion.d/csg && source ~/.bashrc

MacOS: csg completion bash > /usr/local/etc/bash_completion.d/csg && source ~/.bashrc

Now you can type csg [TAB TAB] to see command options:

Now that we have csg installed, let me show you how to use it.

Usage

Below are some examples showing how to use the commands offered by csg.

Adding Credential

The following command add a new credential to the database with the hostname machine.htb. We then specify the application the credential is associated with using the -a flag and then provide the username and password using the -u and -p flags respectively:

csg add -i machine.htb -a 'SQL' -u 'sarah.smith' -p 'SarahSmith_!23'

Retrieving Credentials

The following command retrieves all credentials in the database for the host machine, machine.htb:

csg get -i machine.htb

Updating Credential

The following command updates the application associates with the credential stored in the database with an ID of 3:

csg update --id 3 --app 'docker'

Deleting Credentials

The following command deletes a credential with an ID of 3:

csg delete --id 3

Purging Credentials

The following command removes all credentials associated with the host machine, machine.htb:

csg purge -t 'machine.htb'

Note: to wipe the database, run csg purge -t '*'.

Exporting Credentials

The following command exports all the credentials from the database into a CSV file:

csg export -f captured-creds.csv

If you like this tool, consider giving a star in GitHub. Thanks for reading!

EOF

If you enjoyed reading this article, please follow me on Medium, for more cybersecurity/tech-related articles, and on GitHub, for more cybersecurity programming projects. Thank you for your time!

[embed]bin3xish477 - Overview My name is ✨ Alexis Rodriguez ✨ and I am a Penetration Tester @GuardSight and a part-time Cybersecurity Assistant…github.com