Encrypt sensitive credential fields before event bus emission (#215)

- Add encrypt_credential_dict() and decrypt_credential_field() to utils/crypto.py
- Create utils/credential_encryption.py with encryption/decryption helpers
- Add get_credential_encryption_key() to retrieve key from Infisical at runtime
- Add emit_credential_found() wrapper for modules to use instead of direct bus.emit()
- Update all 15 modules emitting CREDENTIAL_FOUND to use encrypted wrapper
- Update 4 modules consuming CREDENTIAL_FOUND to decrypt payload before processing
- Sensitive fields (username, password, hash, token, etc.) encrypted with AES-256-GCM
- Falls back to plaintext if encryption key unavailable or encryption fails

modules/active/bettercap_mgr.py

@@ -20,6 +20,7 @@ from typing import Optional
 
 from modules.base import BaseModule
 from utils.bettercap_api import BettercapAPI
+from utils.credential_encryption import emit_credential_found
 
 logger = logging.getLogger("sensor.active.bettercap_mgr")
 
@@ -477,7 +478,7 @@ class BettercapManager(BaseModule):
             "credential_value": data.get("password", data.get("hash", "")),
             "raw_data": data,
         }
-        self.bus.emit("CREDENTIAL_FOUND", payload, source_module=self.name)
+        emit_credential_found(self.bus, self.name, payload)
         logger.info(
             "Credential captured: %s@%s (%s)",
             payload["username"], payload["target_ip"], payload["target_service"],

modules/active/evil_twin.py

@@ -23,6 +23,7 @@ from pathlib import Path
 from typing import Optional
 
 from modules.base import BaseModule
+from utils.credential_encryption import emit_credential_found
 
 logger = logging.getLogger("sensor.active.evil_twin")
 

modules/active/mitmproxy_mgr.py

@@ -20,6 +20,7 @@ from pathlib import Path
 from typing import Optional
 
 from modules.base import BaseModule
+from utils.credential_encryption import emit_credential_found
 
 logger = logging.getLogger("sensor.active.mitmproxy_mgr")
 

modules/active/ntlm_relay.py

@@ -18,6 +18,7 @@ import time
 from typing import Optional
 
 from modules.base import BaseModule
+from utils.credential_encryption import emit_credential_found
 
 logger = logging.getLogger("sensor.active.ntlm_relay")
 

modules/active/responder_mgr.py

@@ -20,6 +20,7 @@ from pathlib import Path
 from typing import Optional
 
 from modules.base import BaseModule
+from utils.credential_encryption import emit_credential_found
 
 logger = logging.getLogger("sensor.active.responder_mgr")
 
@@ -403,31 +404,23 @@ class ResponderManager(BaseModule):
         with self._hashes_lock:
             self._captured_hashes.append(hash_entry)
 
-        self.bus.emit(
-            "CREDENTIAL_FOUND",
-            {
-                "source_module": self.name,
-                "source_ip": "",
-                "target_service": "responder",
-                "username": username,
-                "domain": domain,
-                "credential_type": hash_type,
-                "credential_value": line,
-                "hashcat_mode": hashcat_mode,
-            },
-            source_module=self.name,
-        )
+        emit_credential_found(self.bus, self.name, {
+            "source_module": self.name,
+            "source_ip": "",
+            "target_service": "responder",
+            "username": username,
+            "domain": domain,
+            "credential_type": hash_type,
+            "credential_value": line,
+            "hashcat_mode": hashcat_mode,
+        })
         logger.info("Hash captured: %s\\%s (%s)", domain, username, hash_type)
 
     def _process_cleartext_line(self, line: str) -> None:
         """Process a cleartext credential line from Responder session log."""
-        self.bus.emit(
-            "CREDENTIAL_FOUND",
-            {
-                "source_module": self.name,
-                "target_service": "responder_cleartext",
-                "credential_type": "cleartext",
-                "credential_value": line,
-            },
-            source_module=self.name,
-        )
+        emit_credential_found(self.bus, self.name, {
+            "source_module": self.name,
+            "target_service": "responder_cleartext",
+            "credential_type": "cleartext",
+            "credential_value": line,
+        })