THE CYBER TOOLCHAIN
Top pick for August 2026
One product, chosen from everything that won a weekly Head pick over August 2026. Always a product, never a vendor.
adscan
Exploitation & C2
- Head weeks
- 2/5
- Feature releases
- 5
- Finalists
- 8
The Cyber Toolchain
The month’s pick
adscan shipped five feature releases across August, each materially expanding Active Directory attack-path coverage.
Cross-forest Kerberos delegation and MSSQL linked-server chains surfaced as a single blast radius, AD CS ESC5 executed end-to-end with MITRE-mapped reports, and cross-forest Kerberoasting, AS-REP Roasting, and ADCS ESC8/ESC11 relay routes unified into a single graph. The month closed with a minimal-footprint krbtgt-only DCSync mode that proves full domain compromise without broad credential exposure. No other product in August matched this combination of sustained release cadence and closed capability gaps in a single, high-value domain.
The story
If you test Active Directory, the hardest part is rarely one machine. It's the trust boundaries between forests. Kerberos delegation, MSSQL linked-server hops, and certificate relay routes each told their own story, in their own tool, and you were left stitching the real blast radius together by hand. Proving you'd fully owned a domain was worse. The usual way pulled every account, and that heavy footprint is exactly what a live engagement doesn't want.
Over August, adscan closed that gap step by step. First it ran AD CS ESC5 from start to finish and handed you MITRE-mapped coverage reports without extra setup. Then it drew cross-forest Kerberos delegation and MSSQL linked-server chains as one blast radius, with control over how wide trust collection reaches and a clear count of who already holds Tier 0. To finish, it pulled cross-forest Kerberoasting, AS-REP Roasting, and the ADCS relay routes into a single graph, and added a mode that proves full domain compromise using just the one key you need. Less exposure, one picture.
Others shipped good work. Aikido added code-based data-flow tracing and Android pentesting, and Endor Labs scanned C in the IDE. But nobody matched this run of releases, all closing real gaps in one domain. If AD is your job, this is the month that paid off.
How it won
Five Head weeks in August 2026 put 22 products in their top five. One of them is the month’s pick.
- 1 Dreadnode
- 2 Metasploit Pro
- 3 Cribl
- 4 Aikido Security
- 5 Prowler
- 1 adscan
- 2 Elastic Security Labs
- 3 Radare2
- 4 Wiz Code
- 5 Tenzir
- 1 Bugcrowd
- 2 Plerion
- 3 Endor Labs
- 4 GitLab
- 5 Black Duck
- 1 SonarQube
- 2 Aikido Security
- 3 Zscaler
- 4 JFrog
- 5 defectdojo
- 1 Cycode
- 2 Horizon3 NodeZero
- 3 Endor Labs
- 4 adscan
- 5 Binary Ninja
The pick Other finalists Numbers are that week’s Head ranking
What you can do with it
- Run cross-forest attack-path enumeration — Kerberoasting, AS-REP Roasting, ADCS ESC8/ESC11 — across trust boundaries as one unified graph
- Execute AD CS ESC5 end-to-end and get MITRE ATT&CK-mapped coverage reports out of the box
- Use
ADSCAN_TRUST_SCOPEto control trust collection scope and Tier 0 membership counts for blast-radius scoping - Prove full domain compromise with krbtgt-only DCSync mode, minimizing operational footprint during engagements
Examples from what it shipped
Jul 16
ADscan v10.0.0 adds integrated password cracking, broadcast poisoning capture, a harvest command, jobs command, resumable scans, and native macOS/ARM64ARM64A 64-bit CPU architecture from ARM Holdings, used in mobile chips, Apple Silicon, and cloud servers; cyber tools target it to run natively on those platforms instead of relying on emulation. support.
└──▷ GET THIS VERSION
$ git clone --branch v10.0.0 https://github.com/ADScanPro/adscan.git # already have the repo? check out this version: $ git checkout v10.0.0
$ jobs
Adds a harvest command providing a single view of every credential obtained during a…
Adds a harvest command providing a single view of every credential obtained during a scan (captured, cracked, and sprayed), each tagged with its privilege tier and reachable assets, plus an end-of-scan harvest summary.
Adds a jobs command to list, review, and stop long-running background tasks such as…
Adds a jobs command to list, review, and stop long-running background tasks such as broadcast-name-resolution poisoning capture and password cracking.
Adds password-strength auditing built into the scan
Adds password-strength auditing built into the scan: credentials captured via broadcast poisoning, KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. service tickets, and AS-REP hashes are cracked in the background using the bundled 94-million-entry ADscan AD Audit Wordlist and a client-targeted wordlist generator, with recovered passwords fed back into the attack pathattack pathA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. automatically.
- Bundled external third-party command-line cyber tools have been removed; any workflow that relied on them directly must now use ADscan's native engine equivalents.
Jul 25
ADscan v10.1.0 adds SQL Server lateral movementlateral movementMoving from an initially compromised system or identity to other resources in a network. Attackers often use stolen credentials or trusted connections to expand their access., Shadow Credentials, GPO-to-code-execution chaining, and a new adscan execute attack_paths subcommand.
└──▷ GET THIS VERSION
$ git clone --branch v10.1.0 https://github.com/ADScanPro/adscan.git # already have the repo? check out this version: $ git checkout v10.1.0
$ adscan execute attack_paths
New adscan execute attack_paths subcommand runs a single saved attack path or step…
New adscan execute attack_paths subcommand runs a single saved attack path or step against a workspace without a full rescan; resolves credentials automatically for already-owned accounts and a companion re-arm resets step status to re-run a path.
REPL commands now accept flag-form arguments…
REPL commands now accept flag-form arguments -d/--dc-ip/-u/-p/--host/--service alongside the existing positional form, with tab-completion for both flag names and values.
Adds SQL Server attack coverage
Adds SQL Server attack coverage: linked-server lateral movement across domain and forest trusts, automated command execution with escalation to SYSTEM, and arbitrary file read via bulk import — each surfaced as a validated attack step in the report.
Adds Shadow Credentials escalation
Adds Shadow Credentials escalation: detects when it can write a key credential to a target account and executes the full authentication chain end to end.
- Nine REPL commands were renamed to native names; the previous command names are no longer accepted.
- The Blocked by Active Controls report category was removed.
- Running the ADscan core directly on the host machine is now refused; the tool runs only inside its container.
Aug 3
ADscan v11 adds ESC5 end-to-end exploitation, generate_report, writeup, client-logo delivery, and a MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language.-mapped COVERAGE.md
└──▷ GET THIS VERSION
$ git clone --branch v11.0.0 https://github.com/ADScanPro/adscan.git # already have the repo? check out this version: $ git checkout v11.0.0
$ adscan ci auth --type audit --interface eth0 --domain corp.local --dc-ip 10.0.0.1 -u alice -p 'S3cr3t!' --client-logo client_logo.png
Adds adscan deliver --client-logo and adscan ci --client-logo flags accepting PNG…
Adds adscan deliver --client-logo and adscan ci --client-logo flags accepting PNG, SVG, or JPG to embed a client logo in both the free and PRO report covers.
Adds --no-telemetry and --offline flags to adscan start; also restores…
Adds --no-telemetry and --offline flags to adscan start; also restores set telemetry off as per-workspace and introduces set telemetry off global for an operator-wide default.
New generate_report command produces a free self-contained HTML and paginated A4 PDF…
New generate_report command produces a free self-contained HTML and paginated A4 PDF exposure report from any scan; audit-mode scans run it automatically.
New writeup command captures port data, directory contents, the full attack chain as…
New writeup command captures port data, directory contents, the full attack chain as an editable Mermaid diagram, timestamped steps with credential provenanceprovenanceEvidence recording where a software artifact came from and how it was built, including its source and build process. It helps a consumer check that the artifact matches a trusted build., flags, and dead ends into a lab/CTFCTFCapture The Flag — a competitive hacking challenge format where participants exploit intentionally vulnerable systems or puzzles to retrieve hidden strings, used by cyber tools to practice and demonstrate offensive and defensive techniques. writeup; runs automatically on lab and CTF scans.