Credentials

Overview#

JustC2 provides a centralized credential store for managing usernames, passwords, hashes, and other authentication material discovered during an engagement. Credentials can be added automatically by agent operations or manually by operators.

Credential Fields#

Credentials Tab#

The Credentials tab shows all collected credentials in a table view:

Adding Credentials Manually#

Click Add to manually enter a credential:

• Useful for credentials obtained through external tools
• Keeps all engagement credentials in one place
• Can be tagged and organized with the rest

Editing Credentials#

Right-click a credential → Edit to modify its fields.

Removing Credentials#

Right-click → Remove to delete a credential entry.

Tagging#

Right-click → Set Tag to categorize credentials (e.g., domain-admin, service-account, local-admin).

Automated Collection#

When agents execute credential harvesting commands, discovered credentials are automatically added to the store with:

• The agent ID that collected them
• The host they were found on
• The collection method as the storage type
• Timestamps for tracking

Best Practices#

1. Tag consistently — Use a standard tagging scheme across the engagement
2. Record the source — Note which host and method produced each credential
3. Validate before use — Credentials may be stale or have expired
4. Export for reporting — Include credential findings in engagement reports
5. Handle securely — Credentials are sensitive data; follow your engagement’s data handling policies