https://github.com/ADScanPro/adscan
Free Active Directory pentesting tool and Linux CLI for AD enumeration, BloodHound, Kerberoasting, ADCS, DCSync, and attack paths.
https://github.com/ADScanPro/adscan
active-directory active-directory-certificate-services active-directory-exploitation activedirectory adcs adscan bloodhound ctf dcsync enumeration kerberoasting kerberos linux penetration-testing pentest pentest-tool pentesting red-team redteam security-tools
Last synced: 4 days ago
JSON representation
Free Active Directory pentesting tool and Linux CLI for AD enumeration, BloodHound, Kerberoasting, ADCS, DCSync, and attack paths.
- Host: GitHub
- URL: https://github.com/ADScanPro/adscan
- Owner: ADScanPro
- License: other
- Created: 2025-06-27T15:25:36.000Z (10 months ago)
- Default Branch: main
- Last Pushed: 2026-04-15T15:12:07.000Z (14 days ago)
- Last Synced: 2026-04-15T17:14:58.952Z (14 days ago)
- Topics: active-directory, active-directory-certificate-services, active-directory-exploitation, activedirectory, adcs, adscan, bloodhound, ctf, dcsync, enumeration, kerberoasting, kerberos, linux, penetration-testing, pentest, pentest-tool, pentesting, red-team, redteam, security-tools
- Language: Python
- Homepage: https://www.adscanpro.com/docs
- Size: 12.6 MB
- Stars: 253
- Watchers: 1
- Forks: 32
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- Contributing: CONTRIBUTING.md
- License: LICENSE
- Code of conduct: CODE_OF_CONDUCT.md
- Security: SECURITY.md
Awesome Lists containing this project
- venom - `adscan` - focused pentests. (Operating Systems / Windows)
README
# ADscan - Active Directory Pentesting CLI
[](https://github.com/ADscanPro/adscan/releases)
[](https://pepy.tech/projects/adscan)
[](https://github.com/ADscanPro/adscan/blob/main/LICENSE)
[](https://github.com/ADscanPro/adscan)
[](https://discord.com/invite/fXBR3P8H74)
**Free Active Directory pentesting CLI for AD enumeration, BloodHound, Kerberoasting, ADCS, and attack paths.**
ADscan is a free Linux CLI for pentesters, red teamers, and security consultants who need one workflow for Active Directory enumeration, BloodHound collection, Kerberoasting, AS-REP roasting, ADCS checks, password spraying, DCSync, credential dumping, and evidence export.
It is built for real internal Active Directory assessments and labs, so you can go from unauthenticated recon to privilege escalation from one terminal instead of juggling isolated scripts, cheatsheets, and wrappers.
**[Docs](https://adscanpro.com/docs?utm_source=github&utm_medium=readme&utm_campaign=docs_cta)** | [Discord](https://discord.com/invite/fXBR3P8H74) | [Website](https://adscanpro.com)
---
## 🎬 Demo
[](https://asciinema.org/a/734180?autoplay=1)
_Auto-pwns **HTB Forest** in ~3 minutes_
---
## 🚀 Quick Start
```bash
pipx install adscan
adscan install
adscan start
```
> **Full installation guide & docs** at [adscanpro.com/docs](https://adscanpro.com/docs?utm_source=github&utm_medium=readme&utm_campaign=install_cta)
## 🎯 Why Pentesters Use ADscan
- **Active Directory enumeration from one CLI:** DNS, LDAP, SMB, Kerberos, trust, ADCS, and BloodHound-ready collection in one workflow.
- **Attack execution without tool-hopping:** Kerberoasting, AS-REP roasting, password spraying, GPP, DCSync, and credential workflows stay inside the same workspace.
- **Built for real pentest cadence:** use it in internal AD audits, red team operations, HTB/VulnLab labs, and repeatable attack-path validation.
- **Evidence-first output:** keep domain-scoped workspaces and export TXT/JSON artifacts for reports, retesting, or client handoff.
## ⚡ Common Active Directory Pentest Workflows
Use ADscan when you need to move quickly through internal Active Directory assessments:
- **CTF and lab auto-pwn:** reproduce HTB Forest, Active, and Cicada attack chains from the docs.
- **Unauthenticated AD recon:** discover domains, DNS, SMB exposure, null sessions, users, and roastable accounts.
- **Authenticated enumeration:** collect LDAP, SMB, Kerberos, ADCS, BloodHound CE data, and credential exposure.
- **Privilege escalation:** execute supported Kerberoasting, AS-REP Roasting, DCSync, GPP password, ADCS, and local credential workflows.
- **Evidence handling:** keep workspaces isolated and export findings to TXT/JSON for reports.
## 🧭 Usage Examples
```bash
adscan start
start_unauth
```
More walkthroughs:
- [HTB Forest auto-pwn](https://adscanpro.com/docs/labs/htb/forest?utm_source=github&utm_medium=readme&utm_campaign=ctf_forest)
- [HTB Active walkthrough](https://adscanpro.com/docs/labs/htb/active?utm_source=github&utm_medium=readme&utm_campaign=ctf_active)
- [HTB Cicada walkthrough](https://adscanpro.com/docs/labs/htb/cicada?utm_source=github&utm_medium=readme&utm_campaign=ctf_cicada)
## 🧪 Developer Setup (uv)
For local development in this repository:
```bash
uv sync --extra dev
uv run adscan --help
uv run adscan version
```
Quality checks:
```bash
uv run ruff check adscan_core adscan_launcher adscan_internal
uv run pytest -m unit
uv run python -m build
```
---
## ✨ Active Directory Attack Coverage
### LITE (Free, Source Available)
**Everything a pentester could do manually, 10x faster:**
- ✅ Three operation modes (automatic/semi-auto/manual)
- ✅ DNS, LDAP, SMB, Kerberos enumeration
- ✅ AS-REP Roasting & Kerberoasting
- ✅ Password spraying
- ✅ BloodHound collection & analysis
- ✅ Credential harvesting (SAM, LSA, DCSync)
- ✅ ADCS detection & template enumeration
- ✅ GPP passwords & CVE enumeration
- ✅ Export to TXT/JSON
- ✅ Workspace & evidence management
### PRO
**What nobody can do manually in reasonable time:**
- 🎯 Algorithmic attack graph generation
- 🎯 Auto-exploitation chains (DNS to DA)
- 🎯 ADCS ESC1-13 auto-exploitation
- 🎯 MITRE-mapped Word/PDF reports
- 🎯 Multi-domain trust spidering
- 🎯 Advanced privilege escalation chains
- 🎯 Priority enterprise support
[Full comparison](https://adscanpro.com/docs/lite-vs-pro) | [Learn more](https://adscanpro.com?utm_source=github&utm_medium=readme&utm_campaign=pro_cta)
---
## 📋 Requirements
| | |
|---|---|
| **OS** | Linux (Debian/Ubuntu/Kali) |
| **Docker** | Docker Engine + Compose |
| **Privileges** | `docker` group or `sudo` |
| **Network** | Internet (pull images) + target network |
---
## 📜 License
Source available under the [Business Source License 1.1](LICENSE).
- **Use freely** for pentesting (personal or paid engagements)
- **Read, modify, and redistribute** the source code
- **Cannot** create a competing commercial product
- **Converts to Apache 2.0** on 2029-02-01
---
## 💬 Community
[](https://discord.com/invite/fXBR3P8H74)
[](https://github.com/ADscanPro/adscan/issues)
## 🤝 Contributing
Bug reports, lab reproductions, command-output samples, and focused pull requests are welcome. See [CONTRIBUTING.md](CONTRIBUTING.md) and open an issue with your OS, Docker version, ADscan version, command, and sanitized output.
Enterprise support: [hello@adscanpro.com](mailto:hello@adscanpro.com)
---
(c) 2024-2026 Yeray Martin Dominguez | [adscanpro.com](https://adscanpro.com)