ADscan is a free, source-available CLI that consolidates enumeration, Kerberoasting, ADCS analysis, and attack-path graphing into a single workflow for authorized AD pentesters and red teamers.
| Tool | ADScanPro/adscan — free Active Directory pentesting CLI covering 107 AD attack techniques across Linux, macOS, and Windows |
| Category | Active Directory security assessment / red team tooling |
| Primary Use | Consolidating AD recon, LDAP/SMB/Kerberos enumeration, Kerberoasting, AS-REP roasting, ADCS template auditing, and BloodHound-compatible attack-path collection into one terminal session |
| Safe Use | For penetration testers and security consultants operating under written client authorization; LITE enumeration is read-only by default and exploitation steps require explicit operator confirmation. Also suited to lab platforms like HTB |
| Telemetry Note | Generates standard LDAP, SMB, and Kerberos traffic (TGS requests, DCSync replication, null sessions) that domain controllers and DC audit logging will record; exports findings to TXT/JSON workspaces as engagement evidence |
ADscan arrives at a familiar pain point: the modern Active Directory assessment stack has fragmented into five to eight discrete tools that rarely share context. The README opens by pitching the project as a single CLI that replaces the typical chain of NetExec/CrackMapExec, Certipy, Impacket, and BloodHound CE for a large class of engagements. With 693 GitHub stars, a Python codebase, and a BSL 1.1 license (the metadata marks it NOASSERTION, consistent with a source-available rather than pure open-source model), it sits in the growing category of commercial-backed tooling with a genuinely functional free tier. The framing throughout is explicit: this is for pentesters, red teamers, and security consultants working authorized scopes.
Architecturally, the most consequential decision is packaging. On Linux and macOS, ADscan runs entirely inside Docker, which the README says is required — the installer demands 15 GB free and the runtime image unpacks to roughly 12 GB, a hint at how many bundled tools and runtimes the container carries. On Windows, by contrast, there is a self-contained bundle where adscan.exe runs with no Docker, no Python install, and no local admin privileges, with its own runtime and the port scan running in-process so no Npcap driver is needed. This dual-packaging is deliberate: the Windows bundle targets the assumed-breach scenario where the operator's only foothold is a hardened, locked-down, domain-joined box.
The interactive entry point is adscan start, which drops you into a shell with two operation modes on the free LITE tier: automatic, running the flow end-to-end, and semi-automatic, pausing for operator approval at each decision point. That semi-automatic mode is worth noting because it reflects a design philosophy aimed at consultants who need to review each action rather than fire-and-forget automation. The two core commands are start_unauth for zero-credential recon — domain controller discovery, SMB exposure, null sessions, and roastable accounts — and start_auth, which takes a domain user credential and pivots into LDAP enumeration, BloodHound-style collection, and attack-graph construction.
Installation on Linux or macOS follows the modern pipx pattern: pipx install adscan followed by adscan install to pull the runtime image and adscan start to launch. The project is also published on PyPI as adscan, which keeps the distribution surface auditable. A developer section shows the project is managed with uv (uv sync --extra dev, uv run adscan --help) and linted with ruff, which are reasonable signals of maintained, professionally structured Python rather than a script dump.
Technique coverage is the headline number: 107 Active Directory attack techniques, documented in a COVERAGE.md file that the README says is generated from the product catalog and mapped to MITRE ATT&CK. The free tier spans DNS, LDAP, SMB, and Kerberos enumeration; AS-REP roasting and Kerberoasting; password spraying; credential harvesting from SAM, LSA, and DCSync; ADCS detection and certificate template enumeration; GPP password extraction; and CVE enumeration — all with TXT/JSON export and isolated workspace-based evidence management. The graph collection is described as natively compatible with BloodHound CE, meaning data collected by ADscan feeds the standard graph-analysis ecosystem rather than a proprietary dead end.
The comparison table in the README is candid about scope and limits. It positions ADscan against Certipy for ADCS work, noting that Certipy handles ESC exploitation manually where ADscan's automatic ESC1-16 exploitation is gated behind the PRO tier. It also concedes the tool is "not a replacement for every tool in every scenario" — a rare, honest caveat in a market saturated with overclaiming. The claim that survives scrutiny is speed from credentials to a documented attack chain in one terminal session.
The PRO tier is where the business model becomes visible. adscan ci runs the full pipeline — preflight, recon, enumeration, exploitation, reporting — non-interactively with required flags like --type, --interface, and the auth/unauth positional. That automation, along with algorithmic attack-graph generation, unauthenticated-to-Domain-Admin auto-exploitation chains, multi-domain trust spidering, and MITRE-mapped PDF reporting, is reserved for paying users; the free LITE tier retains the full interactive shell on every platform. The PRO deliverable is pitched as three audit-ready PDFs in 90 seconds: a security assessment report with posture scoring, an AD hardening playbook with a 30-day remediation roadmap, and a control coverage report mapped to ENS, NIS2, and ISO 27001.
The demo is interesting from a documentation-quality standpoint: an asciinema recording (asciinema.org/a/734180) shows the tool taking the HackTheBox Forest lab from zero access to Domain Admin in roughly three minutes, unattended. Published walkthroughs for HTB Forest, Active, and Cicada further anchor the tool in CTF and lab territory, which is the right place for practitioners to build fluency before touching client infrastructure. The README's FAQ directly addresses production safety: LITE enumeration is read-only by default, exploitation steps like Kerberoasting, credential dumping, and DCSync require explicit operator confirmation, and the project points to a SECURITY.md with responsible-use guidelines and the advice to run in a test window with written client authorization.
From a defensive perspective, everything ADscan does is observable through standard Windows security telemetry, and blue teams should read this tool's feature list as a checklist of what adversary tradecraft looks like. Kerberoasting manifests as unusual volumes of TGS requests for SPN-backed accounts; AS-REP roasting correlates with pre-auth-free accounts being queried; DCSync appears as directory replication events (replication of directory changes) from non-DC sources; null-session SMB enumeration shows up in old-but-still-diagnostic Netlogon and SMB logon failures. ADCS template enumeration against certificate services is increasingly monitored via ESC-specific certificate template audit events, making ADscan coverage of ESC1-16 a direct mirror of what defenders need to detect.
The FAQ's BloodHound comparison is also analytically useful: BloodHound is graph analysis that historically required separate collectors (SharpHound, AzureHound), whereas ADscan collapses collection, graph building, and execution into one engine. That consolidation is exactly why defenders should care about tooling like this — a single operator session can now traverse the full kill chain, so detection windows that assumed tool-switching delays shrink considerably.
Caveats worth weighing before adopting: the Docker-only requirement on Linux/macOS with a 12 GB runtime image is heavy compared to a lean Impacket install, and the BSL 1.1 licensing means organizations with strict open-source-only procurement policies should review terms carefully. The Windows bundle's no-local-admin operation is operationally convenient but also means the tool's footprint on an endpoint is minimal — another fact defenders should internalize.
For an authorized practitioner deciding whether to add ADscan to the kit, the honest assessment is that the free tier functions as a capable workflow consolidator: enumeration, roasting, credential exposure analysis, and BloodHound-compatible graphing in one shell with evidence workspaces. Whether it replaces your existing chain depends on how much you value single-session cohesion over the flexibility of specialized tools, but at its price point — free, documented, with published lab walkthroughs — it earns a slot in the lab rotation for any Active Directory-focused consultant.
ADScanPro/adscan.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.