ADScanPro/adscan

# ADscan - Active Directory Pentesting CLI [](https://github.com/ADscanPro/adscan/releases) [](https://pepy.tech/projects/adscan) [](https://github.com/ADscanPro/adscan/blob/main/LICENSE) [](https://github.com/ADscanPro/adscan) [](https://discord.com/invite/fXBR3P8H74) **Free Active Directory pentesting CLI for AD enumeration, BloodHound, Kerberoasting, ADCS, and attack paths.** ADscan is a free Linux CLI for pentesters, red teamers, and security consultants who need one workflow for Active Directory enumeration, BloodHound collection, Kerberoasting, AS-REP roasting, ADCS checks, password spraying, DCSync, credential dumping, and evidence export. It is built for real internal Active Directory assessments and labs, so you can go from unauthenticated recon to privilege escalation from one terminal instead of juggling isolated scripts, cheatsheets, and wrappers. **[Docs](https://adscanpro.com/docs?utm_source=github&utm_medium=readme&utm_campaign=docs_cta)** | [Discord](https://discord.com/invite/fXBR3P8H74) | [Website](https://adscanpro.com) ## 🎬 演示 [](https://asciinema.org/a/734180?autoplay=1) _Auto-pwns **HTB Forest** in ~3 minutes_ ## 🚀 快速开始 ``` pipx install adscan adscan install adscan start ``` ## 🎯 为什么渗透测试人员使用 ADscan - **Active Directory enumeration from one CLI:** DNS, LDAP, SMB, Kerberos, trust, ADCS, and BloodHound-ready collection in one workflow. - **Attack execution without tool-hopping:** Kerberoasting, AS-REP roasting, password spraying, GPP, DCSync, and credential workflows stay inside the same workspace. - **Built for real pentest cadence:** use it in internal AD audits, red team operations, HTB/VulnLab labs, and repeatable attack-path validation. - **Evidence-first output:** keep domain-scoped workspaces and export TXT/JSON artifacts for reports, retesting, or client handoff. ## ⚡ 常见的 Active Directory 渗透测试工作流程 Use ADscan when you need to move quickly through internal Active Directory assessments: - **CTF and lab auto-pwn:** reproduce HTB Forest, Active, and Cicada attack chains from the docs. - **Unauthenticated AD recon:** discover domains, DNS, SMB exposure, null sessions, users, and roastable accounts. - **Authenticated enumeration:** collect LDAP, SMB, Kerberos, ADCS, BloodHound CE data, and credential exposure. - **Privilege escalation:** execute supported Kerberoasting, AS-REP Roasting, DCSync, GPP password, ADCS, and local credential workflows. - **Evidence handling:** keep workspaces isolated and export findings to TXT/JSON for reports. ## 🧭 使用示例 ``` adscan start start_unauth ``` More walkthroughs: - [HTB Forest auto-pwn](https://adscanpro.com/docs/labs/htb/forest?utm_source=github&utm_medium=readme&utm_campaign=ctf_forest) - [HTB Active walkthrough](https://adscanpro.com/docs/labs/htb/active?utm_source=github&utm_medium=readme&utm_campaign=ctf_active) - [HTB Cicada walkthrough](https://adscanpro.com/docs/labs/htb/cicada?utm_source=github&utm_medium=readme&utm_campaign=ctf_cicada) ## 🧪 开发者设置（uv） For local development in this repository: ``` uv sync --extra dev uv run adscan --help uv run adscan version ``` Quality checks: ``` uv run ruff check adscan_core adscan_launcher adscan_internal uv run pytest -m unit uv run python -m build ``` ## ✨ Active Directory 攻击覆盖范围

### LITE（免费，源代码可用） **Everything a pentester could do manually, 10x faster:** - ✅ Three operation modes (automatic/semi-auto/manual) - ✅ DNS, LDAP, SMB, Kerberos enumeration - ✅ AS-REP Roasting & Kerberoasting - ✅ Password spraying - ✅ BloodHound collection & analysis - ✅ Credential harvesting (SAM, LSA, DCSync) - ✅ ADCS detection & template enumeration - ✅ GPP passwords & CVE enumeration - ✅ Export to TXT/JSON - ✅ Workspace & evidence management

### PRO **What nobody can do manually in reasonable time:** - 🎯 Algorithmic attack graph generation - 🎯 Auto-exploitation chains (DNS to DA) - 🎯 ADCS ESC1-13 auto-exploitation - 🎯 MITRE-mapped Word/PDF reports - 🎯 Multi-domain trust spidering - 🎯 Advanced privilege escalation chains - 🎯 Priority enterprise support [Full comparison](https://adscanpro.com/docs/lite-vs-pro) | [Learn more](https://adscanpro.com?utm_source=github&utm_medium=readme&utm_campaign=pro_cta)

## 📋 要求 | | | |---|---| | **OS** | Linux (Debian/Ubuntu/Kali) | | **Docker** | Docker Engine + Compose | | **Privileges** | `docker` group or `sudo` | | **Network** | Internet (pull images) + target network | ## 📜 许可证 Source available under the [Business Source License 1.1](LICENSE). - **Use freely** for pentesting (personal or paid engagements) - **Read, modify, and redistribute** the source code - **Cannot** create a competing commercial product - **Converts to Apache 2.0** on 2029-02-01 ## 🤝 贡献 Bug reports, lab reproductions, command-output samples, and focused pull requests are welcome. See [CONTRIBUTING.md](CONTRIBUTING.md) and open an issue with your OS, Docker version, ADscan version, command, and sanitized output. Enterprise support: [hello@adscanpro.com](mailto:hello@adscanpro.com)

标签：Active Directory, ADCS, AD渗透, AS-REP roasting, BloodHound, CSV导出, CTF学习, DCSync, Kerberoasting, Linux CLI, Modbus, PE 加载器, Plaso, Python安全工具, SEO:AD扫描, SILVER, StruQ, 内网渗透, 内部评估, 凭证同步, 协议分析, 取证导出, 域枚举, 域渗透, 安全测试, 密码喷洒, 开源渗透, 攻击性安全, 数据展示, 无线安全, 无认证侦察, 权限提升, 枚举, 标签:AD, 模拟器, 横向移动, 电子数据取证, 红队, 编程规范, 网络安全审计, 蓝队评估, 证书服务, 请求拦截, 超级时间线, 逆向工具