ADscan

Automated Active Directory Security Scanner

Features • Installation • Quick Start • Documentation • Discord

---

🎯 Overview

ADscan is a professional pentesting tool that automates Active Directory reconnaissance, enumeration, and exploitation. It reduces AD assessment time from hours to minutes with an intelligent interactive TUI.

Why ADscan?

• 🚀 Auto-pwns retired HTB machines (Forest, Active, Cicada)
• ⚡ Shrinks AD recon from hours to minutes
• 🎮 Perfect for CTFs, labs, and jump-boxes (100% CLI)
• 🔐 Semi/automatic modes for labs and production environments
• 📊 BloodHound integration with automated path analysis

Try ADscan PRO — Request a 14-day free POV at adscanpro.com 🔥

---

✨ Features

🔓 LITE (Free) ✅ Interactive shell (autocomplete, history) ✅ Unauthenticated & authenticated scans ✅ Kerberos attacks (AS-REP, Kerberoast) ✅ BloodHound data collection ✅ Credential dumping (SAM, LSA, DCSync) ✅ Workspace & credential management ✅ Community Discord support

🔒 PRO (Coming Q4 2025) 🎯 Trust relationship auto-enum 🎫 ADCS ESC auto-exploit 📄 One-click Word/PDF reports ☁️ Cloud-accelerated hash cracking 🔍 Broad CVE/misconfig checks 🏢 Priority enterprise support 🚀 Advanced automation features

---

📋 Requirements

Requirement	Details
OS	Linux (Debian/Ubuntu/Kali and other Debian-based distros)
Privileges	Root access required
Python	3.8+ (managed automatically with binary)
Network	Internet for installation, target network access

---

🚀 Installation

Option 1: pipx (Recommended)

pipx install adscan

Option 2: pip

pip install adscan

Option 3: Pre-built Binary

# Download latest release
wget https://github.com/ADscanPro/adscan/releases/latest/download/adscan
chmod +x adscan
sudo mv adscan /usr/local/bin/

Install Dependencies

# Setup Python environment, tools, and wordlists
adscan install

# Verify installation
adscan check

⚡ Ready to hack! — Run adscan start and share your results with #adscan on X/Twitter.

---

⚡ Quick Start

1️⃣ Start ADscan

adscan start -v

2️⃣ Create Workspace

(ADscan) > workspace create my_audit

3️⃣ Configure Scan

(ADscan:my_audit) > set iface tun0
(ADscan:my_audit) > set auto False  # Semi-automatic (recommended)

4️⃣ Run Scan

Unauthenticated:

(ADscan:my_audit) > set hosts 192.168.1.0/24
(ADscan:my_audit) > start_unauth

Authenticated:

(ADscan:my_audit) > start_auth domain.local 10.10.10.1 username password

5️⃣ Follow Prompts

ADscan guides you through enumeration and exploitation automatically! 🎯

---

🎬 Interactive Demos

Semi-Automatic Mode (auto=False)

Automatic Mode (auto=True)

Auto-pwns HTB Forest in ~3 minutes 🚀

---

🤖 CI/CD Mode

Run ADscan non-interactively for automated testing:

# Unauthenticated scan
adscan ci unauth --type ctf --interface tun0 --hosts 10.10.10.10

# Authenticated scan
adscan ci auth --type ctf --interface tun0 \
  --domain example.local --dc-ip 10.10.10.1 \
  --username user --password pass

# Keep workspace for debugging
adscan ci unauth --type ctf --interface tun0 --hosts 10.10.10.10 --keep-workspace

Exit Codes:

• 0: Success with flags validated
• 1: Scan failed
• 2: Scan successful but flags invalid/missing

---

📚 Documentation

Comprehensive documentation available at adscanpro.com/docs

• 📖 Getting Started
• 🔧 Command Reference
• 🎓 CTF Walkthrough

---

🏆 Tested On

Provider	Machine	Status
Hack The Box	Forest (Retired)	✅ Auto-pwned in ~3min
Hack The Box	Active (Retired)	✅ Auto-pwned
Hack The Box	Cicada (Retired)	✅ Auto-pwned

Contribute: If you auto-pwn labs with ADscan, open a PR to add them to the matrix!

---

🔒 Security & Privacy

• Telemetry: Opt-in by default (toggle with set telemetry off)
• No sensitive data: Only anonymized error data and feature usage
• Local-first: All data stored in ~/.adscan/workspaces/
• Open source LITE: Transparent security tool

---

🗺️ Roadmap

Quarter	Milestone
Q3 2025	More ACL exploitation, pre-2k module, Kerberos unconstrained pathing
Q4 2025	PRO release — Trust enum, ADCS ESC, auto reports
Q1 2026	NTLM relay chain, SCCM module
Q2 2026	PwnDoc integration, cloud-accelerated cracking

Timelines are targets, not promises. Features may adjust based on feedback.

---

💬 Community & Support

Need help?

• 💬 Chat on Discord
• 🐛 Report bugs via GitHub Issues
• 📧 Enterprise support: hello@adscanpro.com

---

🎓 Presented At

Announcement: ADscan was presented at Hackén 2025 cybersecurity conference.

---

📜 License

© 2025 Yeray Martín Domínguez — Released under custom EULA ADscan LITE 2.3.1 | PRO edition: Q4 2025

---

⭐ Star this repo if ADscan helped you! | 🔗 Share with #adscan

Made with ❤️ for the pentesting community