adscan

No entries match these filters. Clear filters

1. v13.2.0 Oct 10, 2026 · issue 102

   adscan v13.2.0 adds local NT hashNT hashA Windows credential storage format that hashes a user's password with MD4, producing a 32-character hex value; cyber tools target it for pass-the-hash attacks or offline cracking because no salt is applied. cracking with GPUGPUA graphics processing unit, a processor that performs many calculations in parallel. AI workloads use GPUs to speed up model training and inference. support in CI, custom-branded deliverables, headless credential dumps, and three new ADCSADCSActive Directory Certificate Services, Microsoft's PKI role for issuing and managing X.509 certificates inside a Windows domain; cyber tools target it because misconfigurations frequently allow privilege escalation or domain compromise. findings.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v13.2.0 https://github.com/ADScanPro/adscan.git
   # already have the repo? check out this version:
   $ git checkout v13.2.0

   └──▷ TRY IT
   Produce a white-label client report with your own cover, logo, and CSS stylesheet, plus a machine-readable data export for further processing.
   copy

   $ adscan deliver --branding whitelabel --client-cover cover.pdf --client-back back.pdf --client-logo logo.png --theme client.css --emit data

   Generate a compliance-scoped ENS audit report for a specific framework without the tool silently defaulting to the wrong regime.
   copy

   $ adscan ci auth --type audit --interface eth0 --domain corp.local --dc-ip 10.0.0.1 -u alice -p 'S3cr3t!' --generate-report --frameworks ENS

   • Adds adscan execute compliance_scope to declare an ENS scope (profile plus per-dimension security levels) so findings are scored against the client's actual regime rather than an assumed category; CCN-STIC 890A and 890C profiles use their own applicability tables.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds ADSCAN_NO_LOCAL_CRACKING=1 to opt out of local NT hash cracking; GPU cracking now works in adscan ci and adscan execute, not only in the interactive workbench, and runs against a time budget measured on your hardware.
   • Adds adscan deliver --branding {adscan,cobrand,whitelabel} together with --client-cover, --client-back, --client-logo, --theme <file.css>, and --emit data (writes report_model.json) to produce co-branded, white-label, or stylesheet-customised deliverables including an HTML edition of the Security Assessment Report.
   • Adds dump_lsa, dump_sam, dump_lsass, dump_dpapi, dump_registries, and dump_host as subcommands of adscan execute, each accepting its own target and credentials, so credential dumps can run without the interactive workbench.
   • Adds ADSCAN_NO_ESC15_CONFIRM=1 and ADSCAN_NO_ESC9_CONFIRM=1 to skip the self-subject certificate issuance that now actively confirms ADCS ESC15, ESC9ESC9A Windows Active Directory privilege-escalation technique exploiting certificate template configurations where the template lacks the security extension, allowing an attacker to abuse certificate enrollment to impersonate other accounts., and ESC10ESC10A Windows Active Directory privilege-escalation vulnerability in certificate template and CA configuration abuse, allowing attackers to impersonate other accounts; tools use it to test PKI misconfigurations. findings instead of inferring them from template attributes.

   +5 more show less

   • Adds ADSCAN_REPORT_CVSS_BASE=1 to print the CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. Base score beside its vector for engagements that require it by contract; CVSS scores are otherwise removed from client deliverables.
   • Adds --frameworks as a required flag for adscan ci --generate-report on audit runs; the tool no longer defaults to ENS and refuses to render without an explicit framework choice.
   • Adds --full-credentials to adscan writeup to include the full recovered-credential table; the default audit output replaces secrets with their shape.
   • Adds endpoint_defense_appendix.csv to the Client Deliverable Kit, listing per-host antivirus and EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. posture, the credential-extraction techniques attempted, and their outcomes, and adds an AD Password Hygiene Report whenever credential recovery ran, covering recovery rate, coverage per privilege tier, and groups of accounts sharing a password.
   • Adds LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. channel binding assessment over StartTLS when a domain controller firewalls LDAPSLDAPSLDAP over TLS — the encrypted variant of the Lightweight Directory Access Protocol, standardized in RFC 2830, used to query directory services like Active Directory without exposing credentials in plaintext., so enforcement is now reported as Required or Not enforced instead of Unknown.
   • Adds adscan execute compliance_scope to declare an ENS scope (profile plus per-dimension security levels) so findings are scored against the client's actual regime rather than an assumed category; CCN-STIC 890A and 890C profiles use their own applicability tables.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds adscan deliver --branding {adscan,cobrand,whitelabel} together with --client-cover, --client-back, --client-logo, --theme <file.css>, and --emit data (writes report_model.json) to produce co-branded, white-label, or stylesheet-customised deliverables including an HTML edition of the Security Assessment Report.
   • Adds dump_lsa, dump_sam, dump_lsass, dump_dpapi, dump_registries, and dump_host as subcommands of adscan execute, each accepting its own target and credentials, so credential dumps can run without the interactive workbench.
   • Adds ADSCAN_REPORT_CVSS_BASE=1 to print the CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. Base score beside its vector for engagements that require it by contract; CVSS scores are otherwise removed from client deliverables.
   • Adds endpoint_defense_appendix.csv to the Client Deliverable Kit, listing per-host antivirus and EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. posture, the credential-extraction techniques attempted, and their outcomes, and adds an AD Password Hygiene Report whenever credential recovery ran, covering recovery rate, coverage per privilege tier, and groups of accounts sharing a password.

   5 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !adscan ci --generate-report no longer defaults to ENS on audit runs — it now requires --frameworks and refuses to render without it.
   • !Client deliverables no longer include CVSS scores by default; set ADSCAN_REPORT_CVSS_BASE=1 to restore the Base score beside its vector.
   • !The lab writeup is no longer produced on any automatic audit path including adscan ci; run adscan writeup explicitly on an audit workspace to generate it.
2. v13.1.0 Sep 25, 2026 · issue 086

   ADscan v13.1.0 adds honest ADCSADCSActive Directory Certificate Services, Microsoft's PKI role for issuing and managing X.509 certificates inside a Windows domain; cyber tools target it because misconfigurations frequently allow privilege escalation or domain compromise. outcome labeling, a Most Exposed Accounts block, and Entra Connect sync-account Tier-0 classification.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v13.1.0 https://github.com/ADScanPro/adscan.git
   # already have the repo? check out this version:
   $ git checkout v13.1.0

   • ADCS findings now report exactly one of three outcomes: validated (CA reachable and escalation completed end-to-end), data gap (weakness detected but CA unreachable, with the next step named), or directory hygiene (decommissioned CA still registered); an ESC8ESC8An Active Directory privilege escalation path where an attacker abuses the Web Enrollment interface of a Microsoft Certificate Authority to coerce NTLM authentication and relay it to obtain a certificate for a privileged account. finding additionally names the web-enrollment transport (HTTP or HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate.) and the observed channel-binding state.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds a Most Exposed Accounts block under the exposure headline in the report and platform, ranking accounts by number of compromise paths that reach them (and how many were validated end-to-end), to prioritize Protected Users membership, tiering, credential rotation, and LAPSLAPSA Microsoft feature that automatically generates, rotates, and stores unique local administrator passwords for each Windows machine in Active Directory, eliminating shared static credentials across a fleet..
   • Identifies Microsoft Entra Connect / MSOL_* directory-synchronization accounts holding directory-replication rights and classifies them as Tier-0 control-plane assets in the report, coverage report, and platform.
   • Attack-path listings in the exposure report now group fan-out routes that reach the same target via the same technique from different footholds into a single finding that names every foothold, reducing dozens of near-duplicate rows to a handful of findings.
   • Shadow Credentials (pre-existing msDS-KeyCredentialLink entries) are now presented as a persistence indicator rather than an active attack step; the operator panel groups and caps objects, surfaces Tier-0 assets first, and defaults the client finding to Medium severity (rising to higher severity only when the affected object is itself Tier-0).
   • ADCS findings now report exactly one of three outcomes: validated (CA reachable and escalation completed end-to-end), data gap (weakness detected but CA unreachable, with the next step named), or directory hygiene (decommissioned CA still registered); an ESC8ESC8An Active Directory privilege escalation path where an attacker abuses the Web Enrollment interface of a Microsoft Certificate Authority to coerce NTLM authentication and relay it to obtain a certificate for a privileged account. finding additionally names the web-enrollment transport (HTTP or HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate.) and the observed channel-binding state.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds a Most Exposed Accounts block under the exposure headline in the report and platform, ranking accounts by number of compromise paths that reach them (and how many were validated end-to-end), to prioritize Protected Users membership, tiering, credential rotation, and LAPSLAPSA Microsoft feature that automatically generates, rotates, and stores unique local administrator passwords for each Windows machine in Active Directory, eliminating shared static credentials across a fleet..
   • Identifies Microsoft Entra Connect / MSOL_* directory-synchronization accounts holding directory-replication rights and classifies them as Tier-0 control-plane assets in the report, coverage report, and platform.

   2 more in Everything

3. v13.0.0 Sep 19, 2026 · issue 2026/q3

   ADscan v13 adds zero-credential kill chains, LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. anonymous bind detection, host credential-protection checks, CIS BenchmarkCIS BenchmarkConsensus-based configuration hardening guidelines published by the Center for Internet Security, covering OSes, cloud platforms, and software; cyber tools use them as a ready-made ruleset to audit or enforce secure system baselines. mapping, and targeted attack-path queries via --target.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v13.0.0 https://github.com/ADScanPro/adscan.git
   # already have the repo? check out this version:
   $ git checkout v13.0.0

   └──▷ TRY IT
   Focus attack-path output on a single high-value target — useful when you want to confirm whether any validated route reaches Domain Admins without scrolling through the full path list.
   copy

   $ attack_paths --target "Domain Admins"

   Check graph scale and density instantly before kicking off a full attack-path discovery run on a large directory.
   copy

   $ graph_stats

   Pull up the full teaching card for a specific technique — MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language. mapping, by-hand command, detection events, and remediation — before executing it in a client engagement.
   copy

   $ explain

   • Adds --target flag to the attack_paths command to query validated routes to one named group, host, or OU — resolves the name to its canonical graph label and lists closest matches on a miss.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds --no-update as an alias for --no-update-check to suppress launcher and runtime version checks in offline/air-gapped runs.
   • Adds graph_stats command to display on-demand node/edge scale, control-hub density, and whether discovery will run in sampled mode; adscan ci prints a one-line version.
   • Adds explain command to render a full teaching card — MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. mapping, by-hand command, detection events, native check, and remediation — for any technique in the coverage set.
   • Attack-path results now persist per workspace and are skipped on --no-cache; the cached set is invalidated automatically when the graph changes.

   +9 more show less

   • Zero-credential attack pathsattack pathsA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. now begin at an explicit Unauthenticated (null session) entry step, rated Critical when the chain reaches full domain compromise, so a zero-credential takeover no longer reports zero critical findings.
   • Adds LDAP Anonymous Bind Enabled as a first-class finding with native remediation (disable anonymous operations via dsHeuristics, strip Anonymous Logon read grants) and a validation bind that should fail after remediation.
   • Adds six host-local credential-protection checks collected over the same session on hosts where the scan account is a local administrator: LSASS RunAsPPL, WDigest cleartext caching, LM hash storage, LAN Manager auth level, minimum NTLMNTLMA Windows authentication protocol that proves knowledge of a password through a challenge and response. Captured authentication exchanges can be abused in relay attacks when protections are absent. session security, and custom Security Support Providers; each carries GPO/registry remediation and a Get-ItemProperty validation step.
   • Adds a configuration check for domains or fine-grained password policies that store passwords with reversible encryption, with native remediation and validation.
   • Compliance reports now support mapping to the CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. Microsoft Windows Server Benchmark alongside ENS, NIS2NIS2EU directive that expands mandatory cybersecurity requirements to more sectors and member states than its predecessor, giving cyber tools a compliance framework to map controls and reporting obligations against., ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability. 27001, DORA, and PCI DSSPCI DSSThe Payment Card Industry Data Security Standard, security requirements for protecting payment account data. It covers organizations that store, process or transmit that data and relevant service providers., version-aware to each host's actual Windows release (Server 2016/2019/2022/2025, Windows 10/11).
   • The compliance scorecard now includes controls ADscan verified as correctly configured (conformant), not only broken ones; a control ADscan could not read stays not assessed rather than assumed compliant.
   • Reports and the CLI now show which non-privileged accounts can reach a Tier-0 asset (domain controller, ADCSADCSActive Directory Certificate Services, Microsoft's PKI role for issuing and managing X.509 certificates inside a Windows domain; cyber tools target it because misconfigurations frequently allow privilege escalation or domain compromise. CA, Exchange server) and by what means: full local administrator, remote session, or database role.
   • Learning mode now teaches the full technique set it executes — ADCS ESC2 through ESC17, coercion/relay techniques (PetitPotam, PrinterBug, DFSCoerce, coerce-and-relay to ADCS), named CVEs (Zerologon, noPac, EternalBlue, PrintNightmare), lateral-movement, DCSyncDCSyncAn attack that abuses Active Directory replication permissions to request password-related data from a domain controller. It imitates the synchronization normally performed between controllers., secret-dump, ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource.-abuse, delegation escalations, and MSSQL escalations — via full teaching cards before execution and on demand through the explain command.
   • Attack-path discovery now shows a pre-flight panel before running, displaying graph node/edge scale, control-hub density, and sampled-mode status.
   • Adds --target flag to the attack_paths command to query validated routes to one named group, host, or OU — resolves the name to its canonical graph label and lists closest matches on a miss.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds graph_stats command to display on-demand node/edge scale, control-hub density, and whether discovery will run in sampled mode; adscan ci prints a one-line version.
   • Adds explain command to render a full teaching card — MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. mapping, by-hand command, detection events, native check, and remediation — for any technique in the coverage set.
   • Adds LDAP Anonymous Bind Enabled as a first-class finding with native remediation (disable anonymous operations via dsHeuristics, strip Anonymous Logon read grants) and a validation bind that should fail after remediation.
   • Adds six host-local credential-protection checks collected over the same session on hosts where the scan account is a local administrator: LSASS RunAsPPL, WDigest cleartext caching, LM hash storage, LAN Manager auth level, minimum NTLMNTLMA Windows authentication protocol that proves knowledge of a password through a challenge and response. Captured authentication exchanges can be abused in relay attacks when protections are absent. session security, and custom Security Support Providers; each carries GPO/registry remediation and a Get-ItemProperty validation step.

   +2 more show less

   • Adds a configuration check for domains or fine-grained password policies that store passwords with reversible encryption, with native remediation and validation.
   • Reports and the CLI now show which non-privileged accounts can reach a Tier-0 asset (domain controller, ADCSADCSActive Directory Certificate Services, Microsoft's PKI role for issuing and managing X.509 certificates inside a Windows domain; cyber tools target it because misconfigurations frequently allow privilege escalation or domain compromise. CA, Exchange server) and by what means: full local administrator, remote session, or database role.

   7 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !Python 3.9 is no longer supported; the minimum supported Python version is now 3.10.
   • !adscan ci is now a PRO-only capability; LITE tier users must use the interactive adscan start workflow.
4. v13.0.0 Sep 19, 2026 · issue 080

   ADscan v13 adds zero-credential kill chains, LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. anonymous bind detection, host credential-protection checks, CIS BenchmarkCIS BenchmarkConsensus-based configuration hardening guidelines published by the Center for Internet Security, covering OSes, cloud platforms, and software; cyber tools use them as a ready-made ruleset to audit or enforce secure system baselines. mapping, and targeted attack-path queries via --target.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v13.0.0 https://github.com/ADScanPro/adscan.git
   # already have the repo? check out this version:
   $ git checkout v13.0.0

   └──▷ TRY IT
   Focus attack-path output on a single high-value target — useful when you want to confirm whether any validated route reaches Domain Admins without scrolling through the full path list.
   copy

   $ attack_paths --target "Domain Admins"

   Check graph scale and density instantly before kicking off a full attack-path discovery run on a large directory.
   copy

   $ graph_stats

   Pull up the full teaching card for a specific technique — MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language. mapping, by-hand command, detection events, and remediation — before executing it in a client engagement.
   copy

   $ explain

   • Adds --target flag to the attack_paths command to query validated routes to one named group, host, or OU — resolves the name to its canonical graph label and lists closest matches on a miss.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds --no-update as an alias for --no-update-check to suppress launcher and runtime version checks in offline/air-gapped runs.
   • Adds graph_stats command to display on-demand node/edge scale, control-hub density, and whether discovery will run in sampled mode; adscan ci prints a one-line version.
   • Adds explain command to render a full teaching card — MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. mapping, by-hand command, detection events, native check, and remediation — for any technique in the coverage set.
   • Attack-path results now persist per workspace and are skipped on --no-cache; the cached set is invalidated automatically when the graph changes.

   +9 more show less

   • Zero-credential attack pathsattack pathsA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. now begin at an explicit Unauthenticated (null session) entry step, rated Critical when the chain reaches full domain compromise, so a zero-credential takeover no longer reports zero critical findings.
   • Adds LDAP Anonymous Bind Enabled as a first-class finding with native remediation (disable anonymous operations via dsHeuristics, strip Anonymous Logon read grants) and a validation bind that should fail after remediation.
   • Adds six host-local credential-protection checks collected over the same session on hosts where the scan account is a local administrator: LSASS RunAsPPL, WDigest cleartext caching, LM hash storage, LAN Manager auth level, minimum NTLMNTLMA Windows authentication protocol that proves knowledge of a password through a challenge and response. Captured authentication exchanges can be abused in relay attacks when protections are absent. session security, and custom Security Support Providers; each carries GPO/registry remediation and a Get-ItemProperty validation step.
   • Adds a configuration check for domains or fine-grained password policies that store passwords with reversible encryption, with native remediation and validation.
   • Compliance reports now support mapping to the CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. Microsoft Windows Server Benchmark alongside ENS, NIS2NIS2EU directive that expands mandatory cybersecurity requirements to more sectors and member states than its predecessor, giving cyber tools a compliance framework to map controls and reporting obligations against., ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability. 27001, DORA, and PCI DSSPCI DSSThe Payment Card Industry Data Security Standard, security requirements for protecting payment account data. It covers organizations that store, process or transmit that data and relevant service providers., version-aware to each host's actual Windows release (Server 2016/2019/2022/2025, Windows 10/11).
   • The compliance scorecard now includes controls ADscan verified as correctly configured (conformant), not only broken ones; a control ADscan could not read stays not assessed rather than assumed compliant.
   • Reports and the CLI now show which non-privileged accounts can reach a Tier-0 asset (domain controller, ADCSADCSActive Directory Certificate Services, Microsoft's PKI role for issuing and managing X.509 certificates inside a Windows domain; cyber tools target it because misconfigurations frequently allow privilege escalation or domain compromise. CA, Exchange server) and by what means: full local administrator, remote session, or database role.
   • Learning mode now teaches the full technique set it executes — ADCS ESC2 through ESC17, coercion/relay techniques (PetitPotam, PrinterBug, DFSCoerce, coerce-and-relay to ADCS), named CVEs (Zerologon, noPac, EternalBlue, PrintNightmare), lateral-movement, DCSyncDCSyncAn attack that abuses Active Directory replication permissions to request password-related data from a domain controller. It imitates the synchronization normally performed between controllers., secret-dump, ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource.-abuse, delegation escalations, and MSSQL escalations — via full teaching cards before execution and on demand through the explain command.
   • Attack-path discovery now shows a pre-flight panel before running, displaying graph node/edge scale, control-hub density, and sampled-mode status.
   • Adds --target flag to the attack_paths command to query validated routes to one named group, host, or OU — resolves the name to its canonical graph label and lists closest matches on a miss.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds graph_stats command to display on-demand node/edge scale, control-hub density, and whether discovery will run in sampled mode; adscan ci prints a one-line version.
   • Adds explain command to render a full teaching card — MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. mapping, by-hand command, detection events, native check, and remediation — for any technique in the coverage set.
   • Adds LDAP Anonymous Bind Enabled as a first-class finding with native remediation (disable anonymous operations via dsHeuristics, strip Anonymous Logon read grants) and a validation bind that should fail after remediation.
   • Adds six host-local credential-protection checks collected over the same session on hosts where the scan account is a local administrator: LSASS RunAsPPL, WDigest cleartext caching, LM hash storage, LAN Manager auth level, minimum NTLMNTLMA Windows authentication protocol that proves knowledge of a password through a challenge and response. Captured authentication exchanges can be abused in relay attacks when protections are absent. session security, and custom Security Support Providers; each carries GPO/registry remediation and a Get-ItemProperty validation step.

   +2 more show less

   • Adds a configuration check for domains or fine-grained password policies that store passwords with reversible encryption, with native remediation and validation.
   • Reports and the CLI now show which non-privileged accounts can reach a Tier-0 asset (domain controller, ADCSADCSActive Directory Certificate Services, Microsoft's PKI role for issuing and managing X.509 certificates inside a Windows domain; cyber tools target it because misconfigurations frequently allow privilege escalation or domain compromise. CA, Exchange server) and by what means: full local administrator, remote session, or database role.

   7 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !Python 3.9 is no longer supported; the minimum supported Python version is now 3.10.
   • !adscan ci is now a PRO-only capability; LITE tier users must use the interactive adscan start workflow.
5. v12.0.0 Sep 8, 2026 · issue 069

   ADscan v12.0.0 adds native Windows support, in-process port scanning, CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. password cracking fallback, and smarter attack-path discovery for large AD environments.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v12.0.0 https://github.com/ADScanPro/adscan.git
   # already have the repo? check out this version:
   $ git checkout v12.0.0

   └──▷ TRY IT
   Run a full authenticated scan from a domain-joined Windows host without Docker, Python, or nmap — common in assumed-breach engagements where you only have a locked-down Windows box.
   copy

   $ adscan.exe ci auth --type audit --interface Ethernet --domain corp.local --dc-ip 10.0.0.1 -u alice -p 'S3cr3t!'

   Raise port-scan throughput on a Windows host when you own the network and want faster coverage than the conservative default pacing.
   copy

   $ set ADSCAN_PORTSCAN_CONCURRENCY=500 && set ADSCAN_PORTSCAN_PER_HOST=20 && adscan.exe ci auth --type audit --interface Ethernet --domain corp.local --dc-ip 10.0.0.1 -u alice -p 'S3cr3t!'

   • Adds ADSCAN_PORTSCAN_CONCURRENCY and ADSCAN_PORTSCAN_PER_HOST environment variables to tune the new Windows in-process TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. connect port scanner.
   • Runs natively on Windows as a self-contained bundle — no Docker, no Python, no nmap, no Npcap required — allowing a low-privilege user on a domain-joined Windows host to run a full scan.
   • Adds in-process async TCP connect port scanning on Windows, replacing the nmap/Npcap dependency that hardened Windows hosts cannot satisfy.
   • Adds CPU fallback for password cracking (AS-REP and Kerberoast hashes) on Windows hosts with no OpenCL/CUDACUDANVIDIA's platform and programming interface for running general computation on its GPUs. Nearly every AI training and inference stack is built on it first. runtime, with recovered credentials recorded the same way as GPUGPUA graphics processing unit, a processor that performs many calculations in parallel. AI workloads use GPUs to speed up model training and inference. cracks.
   • Attack-path discovery now completes on very large, dense directories by switching to a bounded per-target search when the full analysis would exhaust available resources, covering every reachable high-value target.

   +3 more show less

   • Reports and the web platform now plainly declare when attack-path routes are a representative sample rather than the full set, and surface the stable exposure count metric for tracking over time.
   • Domain-wide attack-path discovery now targets Tier-0 (high-value) assets only, with the CLI printing an honest note and listing those targets instead of silently launching an all-objects sweep that cannot finish on large directories.
   • Bulk DNS resolution no longer requires the external massdns binary, now resolving names concurrently through the DC — enabling host resolution on native Windows installs where massdns was unavailable.
   • Adds ADSCAN_PORTSCAN_CONCURRENCY and ADSCAN_PORTSCAN_PER_HOST environment variables to tune the new Windows in-process TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. connect port scanner.
   • Runs natively on Windows as a self-contained bundle — no Docker, no Python, no nmap, no Npcap required — allowing a low-privilege user on a domain-joined Windows host to run a full scan.
   • Adds in-process async TCP connect port scanning on Windows, replacing the nmap/Npcap dependency that hardened Windows hosts cannot satisfy.
   • Adds CPU fallback for password cracking (AS-REP and Kerberoast hashes) on Windows hosts with no OpenCL/CUDACUDANVIDIA's platform and programming interface for running general computation on its GPUs. Nearly every AI training and inference stack is built on it first. runtime, with recovered credentials recorded the same way as GPUGPUA graphics processing unit, a processor that performs many calculations in parallel. AI workloads use GPUs to speed up model training and inference. cracks.

   4 more in Everything

6. v11.3.0 Sep 1, 2026 · issue 2026/q3

   ADscan v11.3.0 adds cross-forest attack pathsattack pathsA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately., didactic mode, seasonal password sprayingpassword sprayingTrying a small number of common passwords across many accounts. Attackers spread attempts out to avoid the lockouts caused by repeatedly guessing one user's password., and krbtgt-only DCSyncDCSyncAn attack that abuses Active Directory replication permissions to request password-related data from a domain controller. It imitates the synchronization normally performed between controllers.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v11.3.0 https://github.com/ADScanPro/adscan.git
   # already have the repo? check out this version:
   $ git checkout v11.3.0

   └──▷ TRY IT
   Run a fully unattended CI scan that includes both month and season spray passes against a domain, using the month_season strategy.
   copy

   $ adscan ci auth --type audit --interface eth0 --domain corp.local --dc-ip 10.0.0.1 -u alice -p 'S3cr3t!'

   Before a KerberoastingKerberoastingAn attack that obtains Kerberos service tickets and tries to crack their encrypted contents offline. Recovering a weak service-account password can give the attacker that account's access. step in a lab, display its full teaching card — MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language. ID, manual equivalent, and detection Event IDs — without triggering the attack.
   copy

   $ explain kerberoasting

   • Adds set explain_level off|basic|deep to control didactic mode verbosity, and explain <technique> (e.g. explain kerberoasting, explain "ADCS ESC1") to show a teaching card — with MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. ID, equivalent manual command, and detection Event IDs — for any technique without executing it.
   • Adds month_season spray strategy to the scan config for seasonal password spraying (e.g. March2026, Verano2026), with per-domain language inference (English/Spanish) and last-password-change awareness when domain credentials are available; runs automatically in adscan ci.
   • DCSync now supports a krbtgt only replication mode, capturing the golden-ticket key without pulling every account — the minimal-footprint path to proving full domain compromise.
   • Attack paths now cross domain and forest boundaries in multi-domain workspaces, analysed as a unified graph; includes cross-forest Kerberoasting, AS-REP RoastingAS-REP RoastingAn attack against Kerberos accounts that do not require pre-authentication. An attacker obtains an encrypted authentication response and tries to crack the account's password offline., and ADCSADCSActive Directory Certificate Services, Microsoft's PKI role for issuing and managing X.509 certificates inside a Windows domain; cyber tools target it because misconfigurations frequently allow privilege escalation or domain compromise. ESC8ESC8An Active Directory privilege escalation path where an attacker abuses the Web Enrollment interface of a Microsoft Certificate Authority to coerce NTLM authentication and relay it to obtain a certificate for a privileged account./ESC11 relay routes across trusts.
   • Automated cross-forest escalation now ships two routes: from a compromised trusted forest into the trusting forest via cross-organization TGT-delegation trust, and from a compromised child domain up to its forest root (RaiseChild), each triggering post-compromise on the reached domain.

   +2 more show less

   • Plaintext credentials in account description or info LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. attributes are now a validated, end-to-end attack step — ADscan reads the attribute, recovers the credential, verifies login, and traces the route across forest boundaries.
   • Reports and the web platform now include a Verify this finding independently block per attack step with native Windows/PowerShell (Get-ADUser, Get-Acl, dsacls, certutil) and Linux equivalents pre-filled with the real DC IP and domain name, covering Kerberoasting, AS-REP Roasting, DCSync, ADCS ESC1, and the GenericAll/GenericWrite/WriteDACL/WriteOwner ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. family.

   7 details in Everything

7. v11.3.0 Sep 1, 2026 · issue 2026/08

   ADscan v11.3.0 adds cross-forest attack pathsattack pathsA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately., didactic mode, seasonal password sprayingpassword sprayingTrying a small number of common passwords across many accounts. Attackers spread attempts out to avoid the lockouts caused by repeatedly guessing one user's password., and krbtgt-only DCSyncDCSyncAn attack that abuses Active Directory replication permissions to request password-related data from a domain controller. It imitates the synchronization normally performed between controllers.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v11.3.0 https://github.com/ADScanPro/adscan.git
   # already have the repo? check out this version:
   $ git checkout v11.3.0

   └──▷ TRY IT
   Run a fully unattended CI scan that includes both month and season spray passes against a domain, using the month_season strategy.
   copy

   $ adscan ci auth --type audit --interface eth0 --domain corp.local --dc-ip 10.0.0.1 -u alice -p 'S3cr3t!'

   Before a KerberoastingKerberoastingAn attack that obtains Kerberos service tickets and tries to crack their encrypted contents offline. Recovering a weak service-account password can give the attacker that account's access. step in a lab, display its full teaching card — MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language. ID, manual equivalent, and detection Event IDs — without triggering the attack.
   copy

   $ explain kerberoasting

   • Adds set explain_level off|basic|deep to control didactic mode verbosity, and explain <technique> (e.g. explain kerberoasting, explain "ADCS ESC1") to show a teaching card — with MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. ID, equivalent manual command, and detection Event IDs — for any technique without executing it.
   • Adds month_season spray strategy to the scan config for seasonal password spraying (e.g. March2026, Verano2026), with per-domain language inference (English/Spanish) and last-password-change awareness when domain credentials are available; runs automatically in adscan ci.
   • DCSync now supports a krbtgt only replication mode, capturing the golden-ticket key without pulling every account — the minimal-footprint path to proving full domain compromise.
   • Attack paths now cross domain and forest boundaries in multi-domain workspaces, analysed as a unified graph; includes cross-forest Kerberoasting, AS-REP RoastingAS-REP RoastingAn attack against Kerberos accounts that do not require pre-authentication. An attacker obtains an encrypted authentication response and tries to crack the account's password offline., and ADCSADCSActive Directory Certificate Services, Microsoft's PKI role for issuing and managing X.509 certificates inside a Windows domain; cyber tools target it because misconfigurations frequently allow privilege escalation or domain compromise. ESC8ESC8An Active Directory privilege escalation path where an attacker abuses the Web Enrollment interface of a Microsoft Certificate Authority to coerce NTLM authentication and relay it to obtain a certificate for a privileged account./ESC11 relay routes across trusts.
   • Automated cross-forest escalation now ships two routes: from a compromised trusted forest into the trusting forest via cross-organization TGT-delegation trust, and from a compromised child domain up to its forest root (RaiseChild), each triggering post-compromise on the reached domain.

   +2 more show less

   • Plaintext credentials in account description or info LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. attributes are now a validated, end-to-end attack step — ADscan reads the attribute, recovers the credential, verifies login, and traces the route across forest boundaries.
   • Reports and the web platform now include a Verify this finding independently block per attack step with native Windows/PowerShell (Get-ADUser, Get-Acl, dsacls, certutil) and Linux equivalents pre-filled with the real DC IP and domain name, covering Kerberoasting, AS-REP Roasting, DCSync, ADCS ESC1, and the GenericAll/GenericWrite/WriteDACL/WriteOwner ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. family.

   7 details in Everything

8. v11.3.0 Sep 1, 2026 · issue 062

   ADscan v11.3.0 adds cross-forest attack pathsattack pathsA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately., didactic mode, seasonal password sprayingpassword sprayingTrying a small number of common passwords across many accounts. Attackers spread attempts out to avoid the lockouts caused by repeatedly guessing one user's password., and krbtgt-only DCSyncDCSyncAn attack that abuses Active Directory replication permissions to request password-related data from a domain controller. It imitates the synchronization normally performed between controllers.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v11.3.0 https://github.com/ADScanPro/adscan.git
   # already have the repo? check out this version:
   $ git checkout v11.3.0

   └──▷ TRY IT
   Run a fully unattended CI scan that includes both month and season spray passes against a domain, using the month_season strategy.
   copy

   $ adscan ci auth --type audit --interface eth0 --domain corp.local --dc-ip 10.0.0.1 -u alice -p 'S3cr3t!'

   Before a KerberoastingKerberoastingAn attack that obtains Kerberos service tickets and tries to crack their encrypted contents offline. Recovering a weak service-account password can give the attacker that account's access. step in a lab, display its full teaching card — MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language. ID, manual equivalent, and detection Event IDs — without triggering the attack.
   copy

   $ explain kerberoasting

   • Adds set explain_level off|basic|deep to control didactic mode verbosity, and explain <technique> (e.g. explain kerberoasting, explain "ADCS ESC1") to show a teaching card — with MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. ID, equivalent manual command, and detection Event IDs — for any technique without executing it.
   • Adds month_season spray strategy to the scan config for seasonal password spraying (e.g. March2026, Verano2026), with per-domain language inference (English/Spanish) and last-password-change awareness when domain credentials are available; runs automatically in adscan ci.
   • DCSync now supports a krbtgt only replication mode, capturing the golden-ticket key without pulling every account — the minimal-footprint path to proving full domain compromise.
   • Attack paths now cross domain and forest boundaries in multi-domain workspaces, analysed as a unified graph; includes cross-forest Kerberoasting, AS-REP RoastingAS-REP RoastingAn attack against Kerberos accounts that do not require pre-authentication. An attacker obtains an encrypted authentication response and tries to crack the account's password offline., and ADCSADCSActive Directory Certificate Services, Microsoft's PKI role for issuing and managing X.509 certificates inside a Windows domain; cyber tools target it because misconfigurations frequently allow privilege escalation or domain compromise. ESC8ESC8An Active Directory privilege escalation path where an attacker abuses the Web Enrollment interface of a Microsoft Certificate Authority to coerce NTLM authentication and relay it to obtain a certificate for a privileged account./ESC11 relay routes across trusts.
   • Automated cross-forest escalation now ships two routes: from a compromised trusted forest into the trusting forest via cross-organization TGT-delegation trust, and from a compromised child domain up to its forest root (RaiseChild), each triggering post-compromise on the reached domain.

   +2 more show less

   • Plaintext credentials in account description or info LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. attributes are now a validated, end-to-end attack step — ADscan reads the attribute, recovers the credential, verifies login, and traces the route across forest boundaries.
   • Reports and the web platform now include a Verify this finding independently block per attack step with native Windows/PowerShell (Get-ADUser, Get-Acl, dsacls, certutil) and Linux equivalents pre-filled with the real DC IP and domain name, covering Kerberoasting, AS-REP Roasting, DCSync, ADCS ESC1, and the GenericAll/GenericWrite/WriteDACL/WriteOwner ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. family.

   7 details in Everything

9. v11.3.0 Sep 1, 2026 · issue 010

   ADscan v11.3.0 adds cross-forest attack pathsattack pathsA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately., didactic mode, seasonal password sprayingpassword sprayingTrying a small number of common passwords across many accounts. Attackers spread attempts out to avoid the lockouts caused by repeatedly guessing one user's password., and krbtgt-only DCSyncDCSyncAn attack that abuses Active Directory replication permissions to request password-related data from a domain controller. It imitates the synchronization normally performed between controllers.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v11.3.0 https://github.com/ADScanPro/adscan.git
   # already have the repo? check out this version:
   $ git checkout v11.3.0

   └──▷ TRY IT
   Run a fully unattended CI scan that includes both month and season spray passes against a domain, using the month_season strategy.
   copy

   $ adscan ci auth --type audit --interface eth0 --domain corp.local --dc-ip 10.0.0.1 -u alice -p 'S3cr3t!'

   Before a KerberoastingKerberoastingAn attack that obtains Kerberos service tickets and tries to crack their encrypted contents offline. Recovering a weak service-account password can give the attacker that account's access. step in a lab, display its full teaching card — MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language. ID, manual equivalent, and detection Event IDs — without triggering the attack.
   copy

   $ explain kerberoasting

   • Adds set explain_level off|basic|deep to control didactic mode verbosity, and explain <technique> (e.g. explain kerberoasting, explain "ADCS ESC1") to show a teaching card — with MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. ID, equivalent manual command, and detection Event IDs — for any technique without executing it.
   • Adds month_season spray strategy to the scan config for seasonal password spraying (e.g. March2026, Verano2026), with per-domain language inference (English/Spanish) and last-password-change awareness when domain credentials are available; runs automatically in adscan ci.
   • DCSync now supports a krbtgt only replication mode, capturing the golden-ticket key without pulling every account — the minimal-footprint path to proving full domain compromise.
   • Attack paths now cross domain and forest boundaries in multi-domain workspaces, analysed as a unified graph; includes cross-forest Kerberoasting, AS-REP RoastingAS-REP RoastingAn attack against Kerberos accounts that do not require pre-authentication. An attacker obtains an encrypted authentication response and tries to crack the account's password offline., and ADCSADCSActive Directory Certificate Services, Microsoft's PKI role for issuing and managing X.509 certificates inside a Windows domain; cyber tools target it because misconfigurations frequently allow privilege escalation or domain compromise. ESC8ESC8An Active Directory privilege escalation path where an attacker abuses the Web Enrollment interface of a Microsoft Certificate Authority to coerce NTLM authentication and relay it to obtain a certificate for a privileged account./ESC11 relay routes across trusts.
   • Automated cross-forest escalation now ships two routes: from a compromised trusted forest into the trusting forest via cross-organization TGT-delegation trust, and from a compromised child domain up to its forest root (RaiseChild), each triggering post-compromise on the reached domain.

   +2 more show less

   • Plaintext credentials in account description or info LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. attributes are now a validated, end-to-end attack step — ADscan reads the attribute, recovers the credential, verifies login, and traces the route across forest boundaries.
   • Reports and the web platform now include a Verify this finding independently block per attack step with native Windows/PowerShell (Get-ADUser, Get-Acl, dsacls, certutil) and Linux equivalents pre-filled with the real DC IP and domain name, covering Kerberoasting, AS-REP Roasting, DCSync, ADCS ESC1, and the GenericAll/GenericWrite/WriteDACL/WriteOwner ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. family.

   7 details in Everything

10. v11.2.0 Aug 23, 2026 · issue 054

    adscan v11.2.0 adds --dns-server for segmented networks and auto-detects a separate DNS host during range discovery.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v11.2.0 https://github.com/ADScanPro/adscan.git
    # already have the repo? check out this version:
    $ git checkout v11.2.0

    └──▷ TRY IT
    Run a CI scan against a segmented network where the AD DNS server is a separate host from the domain controller, preventing silent fallback from KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. to NTLMNTLMA Windows authentication protocol that proves knowledge of a password through a challenge and response. Captured authentication exchanges can be abused in relay attacks when protections are absent..
    copy

    $ adscan ci auth --type audit --interface eth0 --domain corp.local --dc-ip 10.0.0.1 --dns-server 10.0.0.5 -u alice -p 'S3cr3t!'

11. v11.1.0 Aug 10, 2026 · issue 2026/q3

    ADscan v11.1.0 adds cross-forest escalation chains, interactive SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. enrichment scoping, Tier 0 membership counts, and ADSCAN_TRUST_SCOPE trust-collection control.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v11.1.0 https://github.com/ADScanPro/adscan.git
    # already have the repo? check out this version:
    $ git checkout v11.1.0

    └──▷ TRY IT
    Run an audit scan locked to the origin domain only, preventing collection of trusted forests outside the agreed legal scope.
    copy

    $ ADSCAN_TRUST_SCOPE=origin adscan ci auth --type audit --interface eth0 --domain corp.local --dc-ip 10.0.0.1 -u alice -p 'S3cr3t!'

    • Adds ADSCAN_TRUST_SCOPE environment variable (values: all or origin) to control which domains are collected across forest trusts, overridable per scan via the web scan-setup domain-enumeration policy.
    • Surfaces cross-forest KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. ticket delegation as an escalation route, drawing the two forests as one blast radius and adding remediation to disable the delegation.
    • Extends MSSQL linked-server-chain compromise across forest boundaries, coupling SYSTEM-on-DC to directory replication in the target trusted domain and terminating the attack pathattack pathA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. there rather than at the controller.
    • Adds an interactive SMB host-enrichment scope prompt on large directories, letting the operator choose between the recommended host set, a custom count, all hosts, or skipping enrichment entirely; reports and platform state how many hosts were enriched of the reachable total.
    • Reports and platform now show how many accounts already hold Tier 0 privilege by group membership alongside the count reachable via attack pathsattack pathsA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately., with the already-privileged accounts excluded from the attack-path figure.

    +5 more show less

    • Trust relationships are now always mapped regardless of collection scope; domain collection follows engagement type — CTFCTFCapture The Flag — a competitive hacking challenge format where participants exploit intentionally vulnerable systems or puzzles to retrieve hidden strings, used by cyber tools to practice and demonstrate offensive and defensive techniques. scans collect all reachable domains including newly unlocked trusted forests unattended, while audit scans default to the origin domain.
    • Force Change Password steps now follow engagement type in unattended runs: CTF scans reset the target and continue automatically; audit scans skip the reset unless an operator explicitly approves it. Machine account password resets are refused outright in every mode.
    • MSSQL SYSTEM-escalation follow-up and HasSession exploitation steps now offer a choice between minting a fresh privileged account or elevating an account already under the operator's control.
    • HasSession escalation now elevates to the host's own local Administrators group on member servers instead of always adding to Domain Admins.
    • At workspace exit, ADscan prompts whether to delete any account it created during an MSSQL follow-up (default: yes); declining records the exact removal command so nothing is silently left behind.

    10 details in Everything

12. v11.1.0 Aug 10, 2026 · issue 2026/08

    ADscan v11.1.0 adds cross-forest escalation chains, interactive SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. enrichment scoping, Tier 0 membership counts, and ADSCAN_TRUST_SCOPE trust-collection control.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v11.1.0 https://github.com/ADScanPro/adscan.git
    # already have the repo? check out this version:
    $ git checkout v11.1.0

    └──▷ TRY IT
    Run an audit scan locked to the origin domain only, preventing collection of trusted forests outside the agreed legal scope.
    copy

    $ ADSCAN_TRUST_SCOPE=origin adscan ci auth --type audit --interface eth0 --domain corp.local --dc-ip 10.0.0.1 -u alice -p 'S3cr3t!'

    • Adds ADSCAN_TRUST_SCOPE environment variable (values: all or origin) to control which domains are collected across forest trusts, overridable per scan via the web scan-setup domain-enumeration policy.
    • Surfaces cross-forest KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. ticket delegation as an escalation route, drawing the two forests as one blast radius and adding remediation to disable the delegation.
    • Extends MSSQL linked-server-chain compromise across forest boundaries, coupling SYSTEM-on-DC to directory replication in the target trusted domain and terminating the attack pathattack pathA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. there rather than at the controller.
    • Adds an interactive SMB host-enrichment scope prompt on large directories, letting the operator choose between the recommended host set, a custom count, all hosts, or skipping enrichment entirely; reports and platform state how many hosts were enriched of the reachable total.
    • Reports and platform now show how many accounts already hold Tier 0 privilege by group membership alongside the count reachable via attack pathsattack pathsA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately., with the already-privileged accounts excluded from the attack-path figure.

    +5 more show less

    • Trust relationships are now always mapped regardless of collection scope; domain collection follows engagement type — CTFCTFCapture The Flag — a competitive hacking challenge format where participants exploit intentionally vulnerable systems or puzzles to retrieve hidden strings, used by cyber tools to practice and demonstrate offensive and defensive techniques. scans collect all reachable domains including newly unlocked trusted forests unattended, while audit scans default to the origin domain.
    • Force Change Password steps now follow engagement type in unattended runs: CTF scans reset the target and continue automatically; audit scans skip the reset unless an operator explicitly approves it. Machine account password resets are refused outright in every mode.
    • MSSQL SYSTEM-escalation follow-up and HasSession exploitation steps now offer a choice between minting a fresh privileged account or elevating an account already under the operator's control.
    • HasSession escalation now elevates to the host's own local Administrators group on member servers instead of always adding to Domain Admins.
    • At workspace exit, ADscan prompts whether to delete any account it created during an MSSQL follow-up (default: yes); declining records the exact removal command so nothing is silently left behind.

    10 details in Everything

13. v11.1.0 Aug 10, 2026 · issue 042

    ADscan v11.1.0 adds cross-forest escalation chains, interactive SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. enrichment scoping, Tier 0 membership counts, and ADSCAN_TRUST_SCOPE trust-collection control.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v11.1.0 https://github.com/ADScanPro/adscan.git
    # already have the repo? check out this version:
    $ git checkout v11.1.0

    └──▷ TRY IT
    Run an audit scan locked to the origin domain only, preventing collection of trusted forests outside the agreed legal scope.
    copy

    $ ADSCAN_TRUST_SCOPE=origin adscan ci auth --type audit --interface eth0 --domain corp.local --dc-ip 10.0.0.1 -u alice -p 'S3cr3t!'

    • Adds ADSCAN_TRUST_SCOPE environment variable (values: all or origin) to control which domains are collected across forest trusts, overridable per scan via the web scan-setup domain-enumeration policy.
    • Surfaces cross-forest KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. ticket delegation as an escalation route, drawing the two forests as one blast radius and adding remediation to disable the delegation.
    • Extends MSSQL linked-server-chain compromise across forest boundaries, coupling SYSTEM-on-DC to directory replication in the target trusted domain and terminating the attack pathattack pathA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. there rather than at the controller.
    • Adds an interactive SMB host-enrichment scope prompt on large directories, letting the operator choose between the recommended host set, a custom count, all hosts, or skipping enrichment entirely; reports and platform state how many hosts were enriched of the reachable total.
    • Reports and platform now show how many accounts already hold Tier 0 privilege by group membership alongside the count reachable via attack pathsattack pathsA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately., with the already-privileged accounts excluded from the attack-path figure.

    +5 more show less

    • Trust relationships are now always mapped regardless of collection scope; domain collection follows engagement type — CTFCTFCapture The Flag — a competitive hacking challenge format where participants exploit intentionally vulnerable systems or puzzles to retrieve hidden strings, used by cyber tools to practice and demonstrate offensive and defensive techniques. scans collect all reachable domains including newly unlocked trusted forests unattended, while audit scans default to the origin domain.
    • Force Change Password steps now follow engagement type in unattended runs: CTF scans reset the target and continue automatically; audit scans skip the reset unless an operator explicitly approves it. Machine account password resets are refused outright in every mode.
    • MSSQL SYSTEM-escalation follow-up and HasSession exploitation steps now offer a choice between minting a fresh privileged account or elevating an account already under the operator's control.
    • HasSession escalation now elevates to the host's own local Administrators group on member servers instead of always adding to Domain Admins.
    • At workspace exit, ADscan prompts whether to delete any account it created during an MSSQL follow-up (default: yes); declining records the exact removal command so nothing is silently left behind.

    10 details in Everything

14. v11.1.0 Aug 10, 2026 · issue 007

    ADscan v11.1.0 adds cross-forest escalation chains, interactive SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. enrichment scoping, Tier 0 membership counts, and ADSCAN_TRUST_SCOPE trust-collection control.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v11.1.0 https://github.com/ADScanPro/adscan.git
    # already have the repo? check out this version:
    $ git checkout v11.1.0

    └──▷ TRY IT
    Run an audit scan locked to the origin domain only, preventing collection of trusted forests outside the agreed legal scope.
    copy

    $ ADSCAN_TRUST_SCOPE=origin adscan ci auth --type audit --interface eth0 --domain corp.local --dc-ip 10.0.0.1 -u alice -p 'S3cr3t!'

    • Adds ADSCAN_TRUST_SCOPE environment variable (values: all or origin) to control which domains are collected across forest trusts, overridable per scan via the web scan-setup domain-enumeration policy.
    • Surfaces cross-forest KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. ticket delegation as an escalation route, drawing the two forests as one blast radius and adding remediation to disable the delegation.
    • Extends MSSQL linked-server-chain compromise across forest boundaries, coupling SYSTEM-on-DC to directory replication in the target trusted domain and terminating the attack pathattack pathA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. there rather than at the controller.
    • Adds an interactive SMB host-enrichment scope prompt on large directories, letting the operator choose between the recommended host set, a custom count, all hosts, or skipping enrichment entirely; reports and platform state how many hosts were enriched of the reachable total.
    • Reports and platform now show how many accounts already hold Tier 0 privilege by group membership alongside the count reachable via attack pathsattack pathsA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately., with the already-privileged accounts excluded from the attack-path figure.

    +5 more show less

    • Trust relationships are now always mapped regardless of collection scope; domain collection follows engagement type — CTFCTFCapture The Flag — a competitive hacking challenge format where participants exploit intentionally vulnerable systems or puzzles to retrieve hidden strings, used by cyber tools to practice and demonstrate offensive and defensive techniques. scans collect all reachable domains including newly unlocked trusted forests unattended, while audit scans default to the origin domain.
    • Force Change Password steps now follow engagement type in unattended runs: CTF scans reset the target and continue automatically; audit scans skip the reset unless an operator explicitly approves it. Machine account password resets are refused outright in every mode.
    • MSSQL SYSTEM-escalation follow-up and HasSession exploitation steps now offer a choice between minting a fresh privileged account or elevating an account already under the operator's control.
    • HasSession escalation now elevates to the host's own local Administrators group on member servers instead of always adding to Domain Admins.
    • At workspace exit, ADscan prompts whether to delete any account it created during an MSSQL follow-up (default: yes); declining records the exact removal command so nothing is silently left behind.

    10 details in Everything

15. v11.0.0 Aug 3, 2026 · issue 2026/q3

    ADscan v11 adds ESC5 end-to-end exploitation, generate_report, writeup, client-logo delivery, and a MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language.-mapped COVERAGE.md

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v11.0.0 https://github.com/ADScanPro/adscan.git
    # already have the repo? check out this version:
    $ git checkout v11.0.0

    └──▷ TRY IT
    Generate a client-branded exposure report during a non-interactive CI scan, embeddingembeddingLists of numbers a model produces to represent the meaning of text, images or code, so similar items sit close together. They power semantic search and RAG. the client's logo in both the HTML and PDF output.
    copy

    $ adscan ci auth --type audit --interface eth0 --domain corp.local --dc-ip 10.0.0.1 -u alice -p 'S3cr3t!' --client-logo client_logo.png

    • Adds adscan deliver --client-logo and adscan ci --client-logo flags accepting PNG, SVG, or JPG to embed a client logo in both the free and PRO report covers.
    • Adds --no-telemetry and --offline flags to adscan start; also restores set telemetry off as per-workspace and introduces set telemetry off global for an operator-wide default.
    • New generate_report command produces a free self-contained HTML and paginated A4 PDF exposure report from any scan; audit-mode scans run it automatically.
    • New writeup command captures port data, directory contents, the full attack chain as an editable Mermaid diagram, timestamped steps with credential provenanceprovenanceEvidence recording where a software artifact came from and how it was built, including its source and build process. It helps a consumer check that the artifact matches a trusted build., flags, and dead ends into a lab/CTFCTFCapture The Flag — a competitive hacking challenge format where participants exploit intentionally vulnerable systems or puzzles to retrieve hidden strings, used by cyber tools to practice and demonstrate offensive and defensive techniques. writeup; runs automatically on lab and CTF scans.
    • Executes AD CS ESC5 end to end: backs up the CA private key, forges a certificate offline, and authenticates with it from the CA host's machine account or a recovered local-admin password.

    +5 more show less

    • New COVERAGE.md lists all 103 Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. techniques implemented, each mapped to MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. and marked executed, detected, or declined for safety; generated from the product catalog so it cannot drift.
    • Service accounts carrying an HTTP SPN are now flagged as a KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. web-application relay and coercion surface, with native remediation guidance in the report and platform.
    • The Enterprise platform adds a cross-scan exposure comparison view that plots exposure across a workspace's scans and lists findings and attack pathsattack pathsA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. that appeared, closed, or carried over.
    • Collapsed attack paths let the operator choose which interchangeable accounts to target — several at once for a roast or spray, one for a direct step — with unattended runs picking the strongest candidate automatically.
    • Attack paths with interchangeable intermediate accounts collapse into a single finding that names and counts those accounts, reducing report duplication.

    10 details in Everything

16. v11.0.0 Aug 3, 2026 · issue 2026/08

    ADscan v11 adds ESC5 end-to-end exploitation, generate_report, writeup, client-logo delivery, and a MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language.-mapped COVERAGE.md

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v11.0.0 https://github.com/ADScanPro/adscan.git
    # already have the repo? check out this version:
    $ git checkout v11.0.0

    └──▷ TRY IT
    Generate a client-branded exposure report during a non-interactive CI scan, embeddingembeddingLists of numbers a model produces to represent the meaning of text, images or code, so similar items sit close together. They power semantic search and RAG. the client's logo in both the HTML and PDF output.
    copy

    $ adscan ci auth --type audit --interface eth0 --domain corp.local --dc-ip 10.0.0.1 -u alice -p 'S3cr3t!' --client-logo client_logo.png

    • Adds adscan deliver --client-logo and adscan ci --client-logo flags accepting PNG, SVG, or JPG to embed a client logo in both the free and PRO report covers.
    • Adds --no-telemetry and --offline flags to adscan start; also restores set telemetry off as per-workspace and introduces set telemetry off global for an operator-wide default.
    • New generate_report command produces a free self-contained HTML and paginated A4 PDF exposure report from any scan; audit-mode scans run it automatically.
    • New writeup command captures port data, directory contents, the full attack chain as an editable Mermaid diagram, timestamped steps with credential provenanceprovenanceEvidence recording where a software artifact came from and how it was built, including its source and build process. It helps a consumer check that the artifact matches a trusted build., flags, and dead ends into a lab/CTFCTFCapture The Flag — a competitive hacking challenge format where participants exploit intentionally vulnerable systems or puzzles to retrieve hidden strings, used by cyber tools to practice and demonstrate offensive and defensive techniques. writeup; runs automatically on lab and CTF scans.
    • Executes AD CS ESC5 end to end: backs up the CA private key, forges a certificate offline, and authenticates with it from the CA host's machine account or a recovered local-admin password.

    +5 more show less

    • New COVERAGE.md lists all 103 Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. techniques implemented, each mapped to MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. and marked executed, detected, or declined for safety; generated from the product catalog so it cannot drift.
    • Service accounts carrying an HTTP SPN are now flagged as a KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. web-application relay and coercion surface, with native remediation guidance in the report and platform.
    • The Enterprise platform adds a cross-scan exposure comparison view that plots exposure across a workspace's scans and lists findings and attack pathsattack pathsA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. that appeared, closed, or carried over.
    • Collapsed attack paths let the operator choose which interchangeable accounts to target — several at once for a roast or spray, one for a direct step — with unattended runs picking the strongest candidate automatically.
    • Attack paths with interchangeable intermediate accounts collapse into a single finding that names and counts those accounts, reducing report duplication.

    10 details in Everything

17. v11.0.0 Aug 3, 2026 · issue 041

    ADscan v11 adds ESC5 end-to-end exploitation, generate_report, writeup, client-logo delivery, and a MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language.-mapped COVERAGE.md

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v11.0.0 https://github.com/ADScanPro/adscan.git
    # already have the repo? check out this version:
    $ git checkout v11.0.0

    └──▷ TRY IT
    Generate a client-branded exposure report during a non-interactive CI scan, embeddingembeddingLists of numbers a model produces to represent the meaning of text, images or code, so similar items sit close together. They power semantic search and RAG. the client's logo in both the HTML and PDF output.
    copy

    $ adscan ci auth --type audit --interface eth0 --domain corp.local --dc-ip 10.0.0.1 -u alice -p 'S3cr3t!' --client-logo client_logo.png

    • Adds adscan deliver --client-logo and adscan ci --client-logo flags accepting PNG, SVG, or JPG to embed a client logo in both the free and PRO report covers.
    • Adds --no-telemetry and --offline flags to adscan start; also restores set telemetry off as per-workspace and introduces set telemetry off global for an operator-wide default.
    • New generate_report command produces a free self-contained HTML and paginated A4 PDF exposure report from any scan; audit-mode scans run it automatically.
    • New writeup command captures port data, directory contents, the full attack chain as an editable Mermaid diagram, timestamped steps with credential provenanceprovenanceEvidence recording where a software artifact came from and how it was built, including its source and build process. It helps a consumer check that the artifact matches a trusted build., flags, and dead ends into a lab/CTFCTFCapture The Flag — a competitive hacking challenge format where participants exploit intentionally vulnerable systems or puzzles to retrieve hidden strings, used by cyber tools to practice and demonstrate offensive and defensive techniques. writeup; runs automatically on lab and CTF scans.
    • Executes AD CS ESC5 end to end: backs up the CA private key, forges a certificate offline, and authenticates with it from the CA host's machine account or a recovered local-admin password.

    +5 more show less

    • New COVERAGE.md lists all 103 Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. techniques implemented, each mapped to MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. and marked executed, detected, or declined for safety; generated from the product catalog so it cannot drift.
    • Service accounts carrying an HTTP SPN are now flagged as a KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. web-application relay and coercion surface, with native remediation guidance in the report and platform.
    • The Enterprise platform adds a cross-scan exposure comparison view that plots exposure across a workspace's scans and lists findings and attack pathsattack pathsA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. that appeared, closed, or carried over.
    • Collapsed attack paths let the operator choose which interchangeable accounts to target — several at once for a roast or spray, one for a direct step — with unattended runs picking the strongest candidate automatically.
    • Attack paths with interchangeable intermediate accounts collapse into a single finding that names and counts those accounts, reducing report duplication.

    10 details in Everything

18. v11.0.0 Aug 3, 2026 · issue 007

    ADscan v11 adds ESC5 end-to-end exploitation, generate_report, writeup, client-logo delivery, and a MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language.-mapped COVERAGE.md

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v11.0.0 https://github.com/ADScanPro/adscan.git
    # already have the repo? check out this version:
    $ git checkout v11.0.0

    └──▷ TRY IT
    Generate a client-branded exposure report during a non-interactive CI scan, embeddingembeddingLists of numbers a model produces to represent the meaning of text, images or code, so similar items sit close together. They power semantic search and RAG. the client's logo in both the HTML and PDF output.
    copy

    $ adscan ci auth --type audit --interface eth0 --domain corp.local --dc-ip 10.0.0.1 -u alice -p 'S3cr3t!' --client-logo client_logo.png

    • Adds adscan deliver --client-logo and adscan ci --client-logo flags accepting PNG, SVG, or JPG to embed a client logo in both the free and PRO report covers.
    • Adds --no-telemetry and --offline flags to adscan start; also restores set telemetry off as per-workspace and introduces set telemetry off global for an operator-wide default.
    • New generate_report command produces a free self-contained HTML and paginated A4 PDF exposure report from any scan; audit-mode scans run it automatically.
    • New writeup command captures port data, directory contents, the full attack chain as an editable Mermaid diagram, timestamped steps with credential provenanceprovenanceEvidence recording where a software artifact came from and how it was built, including its source and build process. It helps a consumer check that the artifact matches a trusted build., flags, and dead ends into a lab/CTFCTFCapture The Flag — a competitive hacking challenge format where participants exploit intentionally vulnerable systems or puzzles to retrieve hidden strings, used by cyber tools to practice and demonstrate offensive and defensive techniques. writeup; runs automatically on lab and CTF scans.
    • Executes AD CS ESC5 end to end: backs up the CA private key, forges a certificate offline, and authenticates with it from the CA host's machine account or a recovered local-admin password.

    +5 more show less

    • New COVERAGE.md lists all 103 Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. techniques implemented, each mapped to MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. and marked executed, detected, or declined for safety; generated from the product catalog so it cannot drift.
    • Service accounts carrying an HTTP SPN are now flagged as a KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. web-application relay and coercion surface, with native remediation guidance in the report and platform.
    • The Enterprise platform adds a cross-scan exposure comparison view that plots exposure across a workspace's scans and lists findings and attack pathsattack pathsA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. that appeared, closed, or carried over.
    • Collapsed attack paths let the operator choose which interchangeable accounts to target — several at once for a roast or spray, one for a direct step — with unattended runs picking the strongest candidate automatically.
    • Attack paths with interchangeable intermediate accounts collapse into a single finding that names and counts those accounts, reducing report duplication.

    10 details in Everything

19. v10.1.0 Jul 25, 2026 · issue 2026/q3

    ADscan v10.1.0 adds SQL Server lateral movementlateral movementMoving from an initially compromised system or identity to other resources in a network. Attackers often use stolen credentials or trusted connections to expand their access., Shadow Credentials, GPO-to-code-execution chaining, and a new adscan execute attack_paths subcommand.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v10.1.0 https://github.com/ADScanPro/adscan.git
    # already have the repo? check out this version:
    $ git checkout v10.1.0

    └──▷ TRY IT
    Re-run a single saved attack pathattack pathA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. against a workspace after remediating one step, without repeating the full scan.
    copy

    $ adscan execute attack_paths

    Use flag-form arguments in the REPL for scripted or tab-completed input instead of positional syntax.
    copy

    $ start_auth -d 10.0.0.1 -u alice -p 'S3cr3t!' --host corp.local

    • New adscan execute attack_paths subcommand runs a single saved attack path or step against a workspace without a full rescan; resolves credentials automatically for already-owned accounts and a companion re-arm resets step status to re-run a path.
    • REPL commands now accept flag-form arguments -d/--dc-ip/-u/-p/--host/--service alongside the existing positional form, with tab-completion for both flag names and values.
    • Adds SQL Server attack coverage: linked-server lateral movement across domain and forest trusts, automated command execution with escalation to SYSTEM, and arbitrary file read via bulk import — each surfaced as a validated attack step in the report.
    • Adds Shadow Credentials escalation: detects when it can write a key credential to a target account and executes the full authentication chain end to end.
    • Extended-rights escalation (forced password reset, DCSyncDCSyncAn attack that abuses Active Directory replication permissions to request password-related data from a domain controller. It imitates the synchronization normally performed between controllers., LAPSLAPSA Microsoft feature that automatically generates, rotates, and stores unique local administrator passwords for each Windows machine in Active Directory, eliminating shared static credentials across a fleet. password read) is now modeled per target and chained into attack pathsattack pathsA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately..

    +10 more show less

    • GPO control is now chained through to code execution via a scheduled task on machines the GPO applies to.
    • Adds credential capture through a pivot: NTLMNTLMA Windows authentication protocol that proves knowledge of a password through a challenge and response. Captured authentication exchanges can be abused in relay attacks when protections are absent. authentication can be captured across a routed tunnel with per-target selection of the callback address.
    • Adds opt-in writable-share credential bait: plants a bait file on writable shares and captures resulting authentication attempts as a background job that does not block the scan; configurable via new scan-configuration toggles in the CLI and web console.
    • Certificate Services attacks now run through a native implementation, including detection of delegated CA-management rights and detection of Extended Protection on the web-enrollment endpoint (suppressing false ESC8ESC8An Active Directory privilege escalation path where an attacker abuses the Web Enrollment interface of a Microsoft Certificate Authority to coerce NTLM authentication and relay it to obtain a certificate for a privileged account. findings when enrollment is hardened).
    • Adds recovery of secrets protected with PowerShell ConvertFrom-SecureString -Key, chained into share-password findings.
    • Web ports 8080 and 8443 are now included in the important-ports sweep and folded into service discovery.
    • Attack paths now carry more precise result states: Partially Validated, Not Executed for Safety, and Attack Surface Reduced — Hardening Observed.
    • The SQL Server post-authentication workflow now runs automatically in unattended scans instead of defaulting to skip.
    • The AD exposure score now combines proof strength with per-technique exploitability.
    • Remediation guidance is now written entirely in native Microsoft tooling (dsacls, RSAT Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. module, Get-*/Set-* cmdlets) with no third-party product names in client-facing report text.

    15 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Nine REPL commands were renamed to native names; the previous command names are no longer accepted.
    • !The Blocked by Active Controls report category was removed.
    • !Running the ADscan core directly on the host machine is now refused; the tool runs only inside its container.
20. v10.1.0 Jul 25, 2026 · issue 2026/08

    ADscan v10.1.0 adds SQL Server lateral movementlateral movementMoving from an initially compromised system or identity to other resources in a network. Attackers often use stolen credentials or trusted connections to expand their access., Shadow Credentials, GPO-to-code-execution chaining, and a new adscan execute attack_paths subcommand.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v10.1.0 https://github.com/ADScanPro/adscan.git
    # already have the repo? check out this version:
    $ git checkout v10.1.0

    └──▷ TRY IT
    Re-run a single saved attack pathattack pathA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. against a workspace after remediating one step, without repeating the full scan.
    copy

    $ adscan execute attack_paths

    Use flag-form arguments in the REPL for scripted or tab-completed input instead of positional syntax.
    copy

    $ start_auth -d 10.0.0.1 -u alice -p 'S3cr3t!' --host corp.local

    • New adscan execute attack_paths subcommand runs a single saved attack path or step against a workspace without a full rescan; resolves credentials automatically for already-owned accounts and a companion re-arm resets step status to re-run a path.
    • REPL commands now accept flag-form arguments -d/--dc-ip/-u/-p/--host/--service alongside the existing positional form, with tab-completion for both flag names and values.
    • Adds SQL Server attack coverage: linked-server lateral movement across domain and forest trusts, automated command execution with escalation to SYSTEM, and arbitrary file read via bulk import — each surfaced as a validated attack step in the report.
    • Adds Shadow Credentials escalation: detects when it can write a key credential to a target account and executes the full authentication chain end to end.
    • Extended-rights escalation (forced password reset, DCSyncDCSyncAn attack that abuses Active Directory replication permissions to request password-related data from a domain controller. It imitates the synchronization normally performed between controllers., LAPSLAPSA Microsoft feature that automatically generates, rotates, and stores unique local administrator passwords for each Windows machine in Active Directory, eliminating shared static credentials across a fleet. password read) is now modeled per target and chained into attack pathsattack pathsA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately..

    +10 more show less

    • GPO control is now chained through to code execution via a scheduled task on machines the GPO applies to.
    • Adds credential capture through a pivot: NTLMNTLMA Windows authentication protocol that proves knowledge of a password through a challenge and response. Captured authentication exchanges can be abused in relay attacks when protections are absent. authentication can be captured across a routed tunnel with per-target selection of the callback address.
    • Adds opt-in writable-share credential bait: plants a bait file on writable shares and captures resulting authentication attempts as a background job that does not block the scan; configurable via new scan-configuration toggles in the CLI and web console.
    • Certificate Services attacks now run through a native implementation, including detection of delegated CA-management rights and detection of Extended Protection on the web-enrollment endpoint (suppressing false ESC8ESC8An Active Directory privilege escalation path where an attacker abuses the Web Enrollment interface of a Microsoft Certificate Authority to coerce NTLM authentication and relay it to obtain a certificate for a privileged account. findings when enrollment is hardened).
    • Adds recovery of secrets protected with PowerShell ConvertFrom-SecureString -Key, chained into share-password findings.
    • Web ports 8080 and 8443 are now included in the important-ports sweep and folded into service discovery.
    • Attack paths now carry more precise result states: Partially Validated, Not Executed for Safety, and Attack Surface Reduced — Hardening Observed.
    • The SQL Server post-authentication workflow now runs automatically in unattended scans instead of defaulting to skip.
    • The AD exposure score now combines proof strength with per-technique exploitability.
    • Remediation guidance is now written entirely in native Microsoft tooling (dsacls, RSAT Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. module, Get-*/Set-* cmdlets) with no third-party product names in client-facing report text.

    15 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Nine REPL commands were renamed to native names; the previous command names are no longer accepted.
    • !The Blocked by Active Controls report category was removed.
    • !Running the ADscan core directly on the host machine is now refused; the tool runs only inside its container.
21. v10.1.0 Jul 25, 2026 · issue 041

    ADscan v10.1.0 adds SQL Server lateral movementlateral movementMoving from an initially compromised system or identity to other resources in a network. Attackers often use stolen credentials or trusted connections to expand their access., Shadow Credentials, GPO-to-code-execution chaining, and a new adscan execute attack_paths subcommand.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v10.1.0 https://github.com/ADScanPro/adscan.git
    # already have the repo? check out this version:
    $ git checkout v10.1.0

    └──▷ TRY IT
    Re-run a single saved attack pathattack pathA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. against a workspace after remediating one step, without repeating the full scan.
    copy

    $ adscan execute attack_paths

    Use flag-form arguments in the REPL for scripted or tab-completed input instead of positional syntax.
    copy

    $ start_auth -d 10.0.0.1 -u alice -p 'S3cr3t!' --host corp.local

    • New adscan execute attack_paths subcommand runs a single saved attack path or step against a workspace without a full rescan; resolves credentials automatically for already-owned accounts and a companion re-arm resets step status to re-run a path.
    • REPL commands now accept flag-form arguments -d/--dc-ip/-u/-p/--host/--service alongside the existing positional form, with tab-completion for both flag names and values.
    • Adds SQL Server attack coverage: linked-server lateral movement across domain and forest trusts, automated command execution with escalation to SYSTEM, and arbitrary file read via bulk import — each surfaced as a validated attack step in the report.
    • Adds Shadow Credentials escalation: detects when it can write a key credential to a target account and executes the full authentication chain end to end.
    • Extended-rights escalation (forced password reset, DCSyncDCSyncAn attack that abuses Active Directory replication permissions to request password-related data from a domain controller. It imitates the synchronization normally performed between controllers., LAPSLAPSA Microsoft feature that automatically generates, rotates, and stores unique local administrator passwords for each Windows machine in Active Directory, eliminating shared static credentials across a fleet. password read) is now modeled per target and chained into attack pathsattack pathsA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately..

    +10 more show less

    • GPO control is now chained through to code execution via a scheduled task on machines the GPO applies to.
    • Adds credential capture through a pivot: NTLMNTLMA Windows authentication protocol that proves knowledge of a password through a challenge and response. Captured authentication exchanges can be abused in relay attacks when protections are absent. authentication can be captured across a routed tunnel with per-target selection of the callback address.
    • Adds opt-in writable-share credential bait: plants a bait file on writable shares and captures resulting authentication attempts as a background job that does not block the scan; configurable via new scan-configuration toggles in the CLI and web console.
    • Certificate Services attacks now run through a native implementation, including detection of delegated CA-management rights and detection of Extended Protection on the web-enrollment endpoint (suppressing false ESC8ESC8An Active Directory privilege escalation path where an attacker abuses the Web Enrollment interface of a Microsoft Certificate Authority to coerce NTLM authentication and relay it to obtain a certificate for a privileged account. findings when enrollment is hardened).
    • Adds recovery of secrets protected with PowerShell ConvertFrom-SecureString -Key, chained into share-password findings.
    • Web ports 8080 and 8443 are now included in the important-ports sweep and folded into service discovery.
    • Attack paths now carry more precise result states: Partially Validated, Not Executed for Safety, and Attack Surface Reduced — Hardening Observed.
    • The SQL Server post-authentication workflow now runs automatically in unattended scans instead of defaulting to skip.
    • The AD exposure score now combines proof strength with per-technique exploitability.
    • Remediation guidance is now written entirely in native Microsoft tooling (dsacls, RSAT Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. module, Get-*/Set-* cmdlets) with no third-party product names in client-facing report text.

    15 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Nine REPL commands were renamed to native names; the previous command names are no longer accepted.
    • !The Blocked by Active Controls report category was removed.
    • !Running the ADscan core directly on the host machine is now refused; the tool runs only inside its container.
22. v10.1.0 Jul 25, 2026 · issue 007

    ADscan v10.1.0 adds SQL Server lateral movementlateral movementMoving from an initially compromised system or identity to other resources in a network. Attackers often use stolen credentials or trusted connections to expand their access., Shadow Credentials, GPO-to-code-execution chaining, and a new adscan execute attack_paths subcommand.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v10.1.0 https://github.com/ADScanPro/adscan.git
    # already have the repo? check out this version:
    $ git checkout v10.1.0

    └──▷ TRY IT
    Re-run a single saved attack pathattack pathA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. against a workspace after remediating one step, without repeating the full scan.
    copy

    $ adscan execute attack_paths

    Use flag-form arguments in the REPL for scripted or tab-completed input instead of positional syntax.
    copy

    $ start_auth -d 10.0.0.1 -u alice -p 'S3cr3t!' --host corp.local

    • New adscan execute attack_paths subcommand runs a single saved attack path or step against a workspace without a full rescan; resolves credentials automatically for already-owned accounts and a companion re-arm resets step status to re-run a path.
    • REPL commands now accept flag-form arguments -d/--dc-ip/-u/-p/--host/--service alongside the existing positional form, with tab-completion for both flag names and values.
    • Adds SQL Server attack coverage: linked-server lateral movement across domain and forest trusts, automated command execution with escalation to SYSTEM, and arbitrary file read via bulk import — each surfaced as a validated attack step in the report.
    • Adds Shadow Credentials escalation: detects when it can write a key credential to a target account and executes the full authentication chain end to end.
    • Extended-rights escalation (forced password reset, DCSyncDCSyncAn attack that abuses Active Directory replication permissions to request password-related data from a domain controller. It imitates the synchronization normally performed between controllers., LAPSLAPSA Microsoft feature that automatically generates, rotates, and stores unique local administrator passwords for each Windows machine in Active Directory, eliminating shared static credentials across a fleet. password read) is now modeled per target and chained into attack pathsattack pathsA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately..

    +10 more show less

    • GPO control is now chained through to code execution via a scheduled task on machines the GPO applies to.
    • Adds credential capture through a pivot: NTLMNTLMA Windows authentication protocol that proves knowledge of a password through a challenge and response. Captured authentication exchanges can be abused in relay attacks when protections are absent. authentication can be captured across a routed tunnel with per-target selection of the callback address.
    • Adds opt-in writable-share credential bait: plants a bait file on writable shares and captures resulting authentication attempts as a background job that does not block the scan; configurable via new scan-configuration toggles in the CLI and web console.
    • Certificate Services attacks now run through a native implementation, including detection of delegated CA-management rights and detection of Extended Protection on the web-enrollment endpoint (suppressing false ESC8ESC8An Active Directory privilege escalation path where an attacker abuses the Web Enrollment interface of a Microsoft Certificate Authority to coerce NTLM authentication and relay it to obtain a certificate for a privileged account. findings when enrollment is hardened).
    • Adds recovery of secrets protected with PowerShell ConvertFrom-SecureString -Key, chained into share-password findings.
    • Web ports 8080 and 8443 are now included in the important-ports sweep and folded into service discovery.
    • Attack paths now carry more precise result states: Partially Validated, Not Executed for Safety, and Attack Surface Reduced — Hardening Observed.
    • The SQL Server post-authentication workflow now runs automatically in unattended scans instead of defaulting to skip.
    • The AD exposure score now combines proof strength with per-technique exploitability.
    • Remediation guidance is now written entirely in native Microsoft tooling (dsacls, RSAT Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. module, Get-*/Set-* cmdlets) with no third-party product names in client-facing report text.

    15 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Nine REPL commands were renamed to native names; the previous command names are no longer accepted.
    • !The Blocked by Active Controls report category was removed.
    • !Running the ADscan core directly on the host machine is now refused; the tool runs only inside its container.
23. v10.0.0 Jul 16, 2026 · issue 2026/q3

    ADscan v10.0.0 adds integrated password cracking, broadcast poisoning capture, a harvest command, jobs command, resumable scans, and native macOS/ARM64ARM64A 64-bit CPU architecture from ARM Holdings, used in mobile chips, Apple Silicon, and cloud servers; cyber tools target it to run natively on those platforms instead of relying on emulation. support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v10.0.0 https://github.com/ADScanPro/adscan.git
    # already have the repo? check out this version:
    $ git checkout v10.0.0

    └──▷ TRY IT
    Review and stop background cracking or poisoning jobs without interrupting the active scan.
    copy

    $ jobs

    Pull up every credential recovered so far — captured hashes, cracked passwords, and sprayed accounts — with privilege tier and reach, mid-engagement.
    copy

    $ harvest

    Run a fully unattended CI scan with cracking effort and poisoning capture configured ahead of time via the YAML scan-config file.
    copy

    $ adscan ci auth --type audit --interface eth0 --domain corp.local --dc-ip 10.0.0.1 -u alice -p 'S3cr3t!'

    • Adds a harvest command providing a single view of every credential obtained during a scan (captured, cracked, and sprayed), each tagged with its privilege tier and reachable assets, plus an end-of-scan harvest summary.
    • Adds a jobs command to list, review, and stop long-running background tasks such as broadcast-name-resolution poisoning capture and password cracking.
    • Adds cracking-effort and poisoning controls to the YAML scan-config file and the web platform.
    • Adds password-strength auditing built into the scan: credentials captured via broadcast poisoning, KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. service tickets, and AS-REP hashes are cracked in the background using the bundled 94-million-entry ADscan AD Audit Wordlist and a client-targeted wordlist generator, with recovered passwords fed back into the attack pathattack pathA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. automatically.
    • Adds a four-rung selectable cracking-effort ladder calibrated to host hardware, with accurate pre-commit time estimates and live progress/ETA during cracking.

    +5 more show less

    • Adds broadcast name-resolution poisoning capture (LLMNR, NBT-NS, mDNSmDNSA zero-configuration protocol that resolves hostnames to IP addresses on a local network segment without a central DNS server, using multicast UDP on 224.0.0.1:5353. Cyber tools use it to discover hosts and services without active probing.) as a background task, surfaced as a finding and linked attack step, with an explicit consent panel in interactive mode and automatic start in unattended scans.
    • Adds Privilege Blast Radius: reports, the web platform, and the CLI now show the full set of assets and capabilities a single compromised account reaches.
    • Adds resumable scans — interrupted scans (crash, disconnect, or deliberate stop) can resume from the last completed phase or host; the web platform can stop and resume a running scan gracefully.
    • Adds native macOS and Apple Silicon support; LITE and PRO images are now published for ARM64/Apple Silicon in addition to x86-64.
    • Password sprayingPassword sprayingTrying a small number of common passwords across many accounts. Attackers spread attempts out to avoid the lockouts caused by repeatedly guessing one user's password., share enumeration, SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments./LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. hardening checks, local credential verification, and account cleanup now run on ADscan's built-in engine with consistent proxy support, removing the dependency on bundled external command-line tools.

    10 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Bundled external third-party command-line cyber tools have been removed; any workflow that relied on them directly must now use ADscan's native engine equivalents.
24. v10.0.0 Jul 16, 2026 · issue 2026/08

    ADscan v10.0.0 adds integrated password cracking, broadcast poisoning capture, a harvest command, jobs command, resumable scans, and native macOS/ARM64ARM64A 64-bit CPU architecture from ARM Holdings, used in mobile chips, Apple Silicon, and cloud servers; cyber tools target it to run natively on those platforms instead of relying on emulation. support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v10.0.0 https://github.com/ADScanPro/adscan.git
    # already have the repo? check out this version:
    $ git checkout v10.0.0

    └──▷ TRY IT
    Review and stop background cracking or poisoning jobs without interrupting the active scan.
    copy

    $ jobs

    Pull up every credential recovered so far — captured hashes, cracked passwords, and sprayed accounts — with privilege tier and reach, mid-engagement.
    copy

    $ harvest

    Run a fully unattended CI scan with cracking effort and poisoning capture configured ahead of time via the YAML scan-config file.
    copy

    $ adscan ci auth --type audit --interface eth0 --domain corp.local --dc-ip 10.0.0.1 -u alice -p 'S3cr3t!'

    • Adds a harvest command providing a single view of every credential obtained during a scan (captured, cracked, and sprayed), each tagged with its privilege tier and reachable assets, plus an end-of-scan harvest summary.
    • Adds a jobs command to list, review, and stop long-running background tasks such as broadcast-name-resolution poisoning capture and password cracking.
    • Adds cracking-effort and poisoning controls to the YAML scan-config file and the web platform.
    • Adds password-strength auditing built into the scan: credentials captured via broadcast poisoning, KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. service tickets, and AS-REP hashes are cracked in the background using the bundled 94-million-entry ADscan AD Audit Wordlist and a client-targeted wordlist generator, with recovered passwords fed back into the attack pathattack pathA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. automatically.
    • Adds a four-rung selectable cracking-effort ladder calibrated to host hardware, with accurate pre-commit time estimates and live progress/ETA during cracking.

    +5 more show less

    • Adds broadcast name-resolution poisoning capture (LLMNR, NBT-NS, mDNSmDNSA zero-configuration protocol that resolves hostnames to IP addresses on a local network segment without a central DNS server, using multicast UDP on 224.0.0.1:5353. Cyber tools use it to discover hosts and services without active probing.) as a background task, surfaced as a finding and linked attack step, with an explicit consent panel in interactive mode and automatic start in unattended scans.
    • Adds Privilege Blast Radius: reports, the web platform, and the CLI now show the full set of assets and capabilities a single compromised account reaches.
    • Adds resumable scans — interrupted scans (crash, disconnect, or deliberate stop) can resume from the last completed phase or host; the web platform can stop and resume a running scan gracefully.
    • Adds native macOS and Apple Silicon support; LITE and PRO images are now published for ARM64/Apple Silicon in addition to x86-64.
    • Password sprayingPassword sprayingTrying a small number of common passwords across many accounts. Attackers spread attempts out to avoid the lockouts caused by repeatedly guessing one user's password., share enumeration, SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments./LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. hardening checks, local credential verification, and account cleanup now run on ADscan's built-in engine with consistent proxy support, removing the dependency on bundled external command-line tools.

    10 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Bundled external third-party command-line cyber tools have been removed; any workflow that relied on them directly must now use ADscan's native engine equivalents.
25. v10.0.0 Jul 16, 2026 · issue 041

    ADscan v10.0.0 adds integrated password cracking, broadcast poisoning capture, a harvest command, jobs command, resumable scans, and native macOS/ARM64ARM64A 64-bit CPU architecture from ARM Holdings, used in mobile chips, Apple Silicon, and cloud servers; cyber tools target it to run natively on those platforms instead of relying on emulation. support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v10.0.0 https://github.com/ADScanPro/adscan.git
    # already have the repo? check out this version:
    $ git checkout v10.0.0

    └──▷ TRY IT
    Review and stop background cracking or poisoning jobs without interrupting the active scan.
    copy

    $ jobs

    Pull up every credential recovered so far — captured hashes, cracked passwords, and sprayed accounts — with privilege tier and reach, mid-engagement.
    copy

    $ harvest

    Run a fully unattended CI scan with cracking effort and poisoning capture configured ahead of time via the YAML scan-config file.
    copy

    $ adscan ci auth --type audit --interface eth0 --domain corp.local --dc-ip 10.0.0.1 -u alice -p 'S3cr3t!'

    • Adds a harvest command providing a single view of every credential obtained during a scan (captured, cracked, and sprayed), each tagged with its privilege tier and reachable assets, plus an end-of-scan harvest summary.
    • Adds a jobs command to list, review, and stop long-running background tasks such as broadcast-name-resolution poisoning capture and password cracking.
    • Adds cracking-effort and poisoning controls to the YAML scan-config file and the web platform.
    • Adds password-strength auditing built into the scan: credentials captured via broadcast poisoning, KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. service tickets, and AS-REP hashes are cracked in the background using the bundled 94-million-entry ADscan AD Audit Wordlist and a client-targeted wordlist generator, with recovered passwords fed back into the attack pathattack pathA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. automatically.
    • Adds a four-rung selectable cracking-effort ladder calibrated to host hardware, with accurate pre-commit time estimates and live progress/ETA during cracking.

    +5 more show less

    • Adds broadcast name-resolution poisoning capture (LLMNR, NBT-NS, mDNSmDNSA zero-configuration protocol that resolves hostnames to IP addresses on a local network segment without a central DNS server, using multicast UDP on 224.0.0.1:5353. Cyber tools use it to discover hosts and services without active probing.) as a background task, surfaced as a finding and linked attack step, with an explicit consent panel in interactive mode and automatic start in unattended scans.
    • Adds Privilege Blast Radius: reports, the web platform, and the CLI now show the full set of assets and capabilities a single compromised account reaches.
    • Adds resumable scans — interrupted scans (crash, disconnect, or deliberate stop) can resume from the last completed phase or host; the web platform can stop and resume a running scan gracefully.
    • Adds native macOS and Apple Silicon support; LITE and PRO images are now published for ARM64/Apple Silicon in addition to x86-64.
    • Password sprayingPassword sprayingTrying a small number of common passwords across many accounts. Attackers spread attempts out to avoid the lockouts caused by repeatedly guessing one user's password., share enumeration, SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments./LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. hardening checks, local credential verification, and account cleanup now run on ADscan's built-in engine with consistent proxy support, removing the dependency on bundled external command-line tools.

    10 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Bundled external third-party command-line cyber tools have been removed; any workflow that relied on them directly must now use ADscan's native engine equivalents.
26. v10.0.0 Jul 16, 2026 · issue 007

    ADscan v10.0.0 adds integrated password cracking, broadcast poisoning capture, a harvest command, jobs command, resumable scans, and native macOS/ARM64ARM64A 64-bit CPU architecture from ARM Holdings, used in mobile chips, Apple Silicon, and cloud servers; cyber tools target it to run natively on those platforms instead of relying on emulation. support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v10.0.0 https://github.com/ADScanPro/adscan.git
    # already have the repo? check out this version:
    $ git checkout v10.0.0

    └──▷ TRY IT
    Review and stop background cracking or poisoning jobs without interrupting the active scan.
    copy

    $ jobs

    Pull up every credential recovered so far — captured hashes, cracked passwords, and sprayed accounts — with privilege tier and reach, mid-engagement.
    copy

    $ harvest

    Run a fully unattended CI scan with cracking effort and poisoning capture configured ahead of time via the YAML scan-config file.
    copy

    $ adscan ci auth --type audit --interface eth0 --domain corp.local --dc-ip 10.0.0.1 -u alice -p 'S3cr3t!'

    • Adds a harvest command providing a single view of every credential obtained during a scan (captured, cracked, and sprayed), each tagged with its privilege tier and reachable assets, plus an end-of-scan harvest summary.
    • Adds a jobs command to list, review, and stop long-running background tasks such as broadcast-name-resolution poisoning capture and password cracking.
    • Adds cracking-effort and poisoning controls to the YAML scan-config file and the web platform.
    • Adds password-strength auditing built into the scan: credentials captured via broadcast poisoning, KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. service tickets, and AS-REP hashes are cracked in the background using the bundled 94-million-entry ADscan AD Audit Wordlist and a client-targeted wordlist generator, with recovered passwords fed back into the attack pathattack pathA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. automatically.
    • Adds a four-rung selectable cracking-effort ladder calibrated to host hardware, with accurate pre-commit time estimates and live progress/ETA during cracking.

    +5 more show less

    • Adds broadcast name-resolution poisoning capture (LLMNR, NBT-NS, mDNSmDNSA zero-configuration protocol that resolves hostnames to IP addresses on a local network segment without a central DNS server, using multicast UDP on 224.0.0.1:5353. Cyber tools use it to discover hosts and services without active probing.) as a background task, surfaced as a finding and linked attack step, with an explicit consent panel in interactive mode and automatic start in unattended scans.
    • Adds Privilege Blast Radius: reports, the web platform, and the CLI now show the full set of assets and capabilities a single compromised account reaches.
    • Adds resumable scans — interrupted scans (crash, disconnect, or deliberate stop) can resume from the last completed phase or host; the web platform can stop and resume a running scan gracefully.
    • Adds native macOS and Apple Silicon support; LITE and PRO images are now published for ARM64/Apple Silicon in addition to x86-64.
    • Password sprayingPassword sprayingTrying a small number of common passwords across many accounts. Attackers spread attempts out to avoid the lockouts caused by repeatedly guessing one user's password., share enumeration, SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments./LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. hardening checks, local credential verification, and account cleanup now run on ADscan's built-in engine with consistent proxy support, removing the dependency on bundled external command-line tools.

    10 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Bundled external third-party command-line cyber tools have been removed; any workflow that relied on them directly must now use ADscan's native engine equivalents.
27. v9.2.1 Jun 29, 2026 · release notes

    adscan v9.2.1 adds preflight doctor command, non-interactive execute subcommand, and per-phase scan-config support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v9.2.1 https://github.com/ADScanPro/adscan.git
    # already have the repo? check out this version:
    $ git checkout v9.2.1

    • Adds adscan doctor preflight command for connection checks with JSON output
    • Adds adscan execute <verb> command to run a single step non-interactively
    • Adds --scan-config CLI argument to specify a file for per-phase scan configuration
    • Removes WeasyPrint PDF path; Chromium is now the sole report engine and only --report-engine choice

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The WeasyPrint PDF path was removed; Chromium is now the sole report engine and the only --report-engine choice
28. v9.2.0 Jun 23, 2026 · release notes

    adscan v9.2.0 adds live web console, offline VM cred extraction, NIS2NIS2EU directive that expands mandatory cybersecurity requirements to more sectors and member states than its predecessor, giving cyber tools a compliance framework to map controls and reporting obligations against. framework, and MSSQL/AD Recycle Bin attack surfacesattack surfacesThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources..

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v9.2.0 https://github.com/ADScanPro/adscan.git
    # already have the repo? check out this version:
    $ git checkout v9.2.0

    • Offline credential extraction from virtual-machine artifacts (virtual disks, snapshots, differencing chains, memory images) left on shares
    • MSSQL authorization mapping adds SQL access and sysadmin rights to the attack graph as escalation paths
    • Machine-password rotation auditing recovers the real rotation interval and reports stale machine passwords
    • NIS2 is now a distinct, selectable compliance framework in the web platform
    • Engagement-posture Settings with independent Offline-mode and Send-telemetry toggles applied per scan

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Deliverables restructured into three documents: Security Assessment Report, AD Hardening Playbook, and AD Control Coverage Report; the standalone MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language. Remediation Checklist and Coverage Matrix deliverables are removed
    • !Compliance frameworks are now opt-in instead of showing a fixed default set
29. v9.1.1 Jun 9, 2026 · release notes

    ADscan v9.1.1 adds AD Exposure Score metric, proven credentials from writable shares, and faster PRO scans

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v9.1.1 https://github.com/ADScanPro/adscan.git
    # already have the repo? check out this version:
    $ git checkout v9.1.1

    • AD Exposure Score added to executive summary, PDF hero, technical report JSON, and web dashboard trends.
    • New Sample teaser report profile for cold outreach.
    • SMB Share Exposure phase now captures credentials from writable shares via a planted lure.
    • PRO runs performance improved to match LITE (12-20x faster on large graphs).
    • Attack pathsAttack pathsA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. reaching full domain compromise are now ranked higher than foothold-only paths.

    +1 more show less

    • Unbound CI audit runs now capped at top 25 highest-risk shares with deep-analysis skipped by default.

    6 details in Everything

30. v9.1.0 Jun 4, 2026 · release notes

    ADScan v9.1 adds SPN-jacking detection, NTLMv1NTLMv1A Windows authentication protocol that proves knowledge of a password through a challenge and response. Captured authentication exchanges can be abused in relay attacks when protections are absent. per-host sweep, MSSQL to DA escalation, and effective share access reporting.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v9.1.0 https://github.com/ADScanPro/adscan.git
    # already have the repo? check out this version:
    $ git checkout v9.1.0

    • adscan now detects and executes SPN-jacking with constrained delegation, modeling the attack graph in reports
    • Per-host NTLMv1 exposure sweep with live classification dashboard and compliance mappings (ENS, NIS2NIS2EU directive that expands mandatory cybersecurity requirements to more sectors and member states than its predecessor, giving cyber tools a compliance framework to map controls and reporting obligations against., DORA, ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability. 27001, PCI DSSPCI DSSThe Payment Card Industry Data Security Standard, security requirements for protecting payment account data. It covers organizations that store, process or transmit that data and relevant service providers.)
    • New relay command for NTLMNTLMA Windows authentication protocol that proves knowledge of a password through a challenge and response. Captured authentication exchanges can be abused in relay attacks when protections are absent.-relay-to-LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. workflow with resource-based delegation or Shadow Credentials
    • Passive credential capture via writable-share bait file with per-folder targeting and offline cracking
    • MSSQL service-account impersonation escalation to Domain Admin, including DC takeover options

    +3 more show less

    • SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. share enumeration reports effective access (share + NTFSNTFSThe default file system format for Windows, developed by Microsoft, storing files with rich metadata and access controls; cyber tools target it to parse artifacts like timestamps, alternate data streams, and the MFT. permissions) instead of share-level only
    • Collection scope selector allows choosing sub-collections (directory/ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. base, local accounts, shares) at start
    • Live progress dashboard for SMB collection, KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. user enumeration, password sprayingpassword sprayingTrying a small number of common passwords across many accounts. Attackers spread attempts out to avoid the lockouts caused by repeatedly guessing one user's password., and important-port scan

    8 details in Everything

31. v5.1.0 Mar 3, 2026 · release notes

    v5.1.0 adds Domain Admin Session attack step, caching, and improved cracking workflows

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v5.1.0 https://github.com/ADScanPro/adscan.git
    # already have the repo? check out this version:
    $ git checkout v5.1.0

    • Added Domain Admin Sessions as a new attack step in attack pathattack pathA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. execution
    • Added attack path cache for faster attack path generation and better responsiveness
    • Improved local credential reuse logic for more accurate path generation

    3 details in Everything

32. v5.0.0 Feb 26, 2026 · release notes

    AdScan v5.0.0 adds AI integration to the shell workflow for analysis support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v5.0.0 https://github.com/ADScanPro/adscan.git
    # already have the repo? check out this version:
    $ git checkout v5.0.0

    • Integrates AI directly in the adscan shell to speed up analysis and operator decision-making.

    1 detail in Everything

33. v4.1.2 Feb 10, 2026 · release notes

    adscan v4.1.2 adds workspace clear confirmation, improves CI logic and BloodHound ZIP efficiency

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v4.1.2 https://github.com/ADScanPro/adscan.git
    # already have the repo? check out this version:
    $ git checkout v4.1.2

    • Added a confirmation prompt before clearing a workspace to prevent accidental data loss
    • Improved adscan ci logic for more robust non-interactive execution
    • Made ZIP upload to BloodHound more efficient

    3 details in Everything

34. v4.1.1 Feb 4, 2026 · release notes

    ADScan v4.1.1 adds min disk validation for install and improved BloodHound timeouts.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v4.1.1 https://github.com/ADScanPro/adscan.git
    # already have the repo? check out this version:
    $ git checkout v4.1.1

    • Adds minimum free disk space validation for adscan install with clearer error handling
    • Increases default timeout duration for the BloodHound collector to support large/complex domains

    2 details in Everything

35. v4.1.0 Feb 2, 2026 · release notes

    ADScan v4.1.0 adds DCSyncDCSyncAn attack that abuses Active Directory replication permissions to request password-related data from a domain controller. It imitates the synchronization normally performed between controllers. fallback, WriteSPN exploitation, and KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application.-first ADCSADCSActive Directory Certificate Services, Microsoft's PKI role for issuing and managing X.509 certificates inside a Windows domain; cyber tools target it because misconfigurations frequently allow privilege escalation or domain compromise. enumeration

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v4.1.0 https://github.com/ADScanPro/adscan.git
    # already have the repo? check out this version:
    $ git checkout v4.1.0

    • pypykatz integration dumps hashes directly from .DMP files without leaving adscan.
    • DCSync fallback chain automatically tries SAM, LSALSALocal Security Authority — a Windows subsystem that handles authentication, enforces local security policy, and stores credential material, making it a frequent target for credential-harvesting cyber tools., and DPAPIDPAPIA Windows OS cryptographic API that encrypts and decrypts secrets tied to a user or machine identity, so applications can store credentials without managing raw keys themselves. dump when primary DCSync fails.
    • New attack pathattack pathA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. for WriteSPN ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. exploitation enables SPN manipulation.
    • ADCS enumeration and exploitation now defaults to Kerberos authentication via the new Kerberos-first logic.
    • SeBackupPrivilege privilege escalationprivilege escalationGaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources. changed from WinRMWinRMA Windows-native remote management protocol from Microsoft, implementing the WS-Management standard, that lets tools execute commands and access data on remote Windows hosts over HTTP or HTTPS. to SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. for broader compatibility.

    5 details in Everything

36. v4.0.0 Jan 26, 2026 · release notes

    adscan v4.0 adds NTLMNTLMA Windows authentication protocol that proves knowledge of a password through a challenge and response. Captured authentication exchanges can be abused in relay attacks when protections are absent. fallback, BloodHound CE attack pathattack pathA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. search, optional workspace cleanup, and changes BH CE port to 8443.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v4.0.0 https://github.com/ADScanPro/adscan.git
    # already have the repo? check out this version:
    $ git checkout v4.0.0

    • Added NTLM fallback when KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. fails
    • New attack path execution flow with step‑by‑step actions
    • Added BloodHound CE attack path search
    • Added optional workspace cleanup before scans
    • BloodHound CE default port changed from 8080 → 8443

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !BloodHound CE now listens on port 8443 instead of 8080 by default
37. v3.2.1 Jan 4, 2026 · release notes

    ADscan v3.2.1 shifts default runtime to Docker and exposes --legacy flag for host-based installs

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.2.1 https://github.com/ADScanPro/adscan.git
    # already have the repo? check out this version:
    $ git checkout v3.2.1

    • adscan install now pulls the ADscan Docker image and prepares the BloodHound CE compose stack.
    • adscan start launches ADscan inside the container with host workspaces mounted.
    • Adsan check validates Docker prerequisites and container readiness, bypassing legacy host dependency checks unless requested.
    • The --legacy flag enables the previous host-based installer and check path.
    • Docker-mode includes automatic handling for the BloodHound CE stack to ensure required images and configs are present.

    5 details in Everything

38. v3.1.4 Dec 23, 2025 · release notes

    ADScan v3.1.4 adds non-root execution default, --fix flag to check, and UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery.->DNS TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. fallback

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.1.4 https://github.com/ADScanPro/adscan.git
    # already have the repo? check out this version:
    $ git checkout v3.1.4

    └──▷ USE IT
    Automatically attempt to repair detected configuration or dependency issues during a check run
    shell copy

    adscan check --fix

    • Adds --fix parameter to the check command to automatically fix detected issues
    • Adds DNS UDP→TCP fallback mechanism for improved network resilience
    • ADscan now exits when apt update fails instead of warning

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !apt update errors now stop the process instead of warning
39. v3.1.0 Dec 13, 2025 · release notes

    ADscan v3.1.0 adds automatic credential extraction from SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. descriptions and PSTranscripts, plus password-spraying re-use workflow

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.1.0 https://github.com/ADScanPro/adscan.git
    # already have the repo? check out this version:
    $ git checkout v3.1.0

    • Adds --extract-smb-desc flag to automatically extract credentials from SMB share descriptions (including null session contexts)
    • Adds interactive prompt/flow to re-run password sprayingpassword sprayingTrying a small number of common passwords across many accounts. Attackers spread attempts out to avoid the lockouts caused by repeatedly guessing one user's password. with discovered passwords to identify additional users

    2 details in Everything

40. v3.0.1 Dec 1, 2025 · release notes

    ADScan v3.0.1 adds CI command, BloodHound-first enumeration, and automated credential extraction

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.0.1 https://github.com/ADScanPro/adscan.git
    # already have the repo? check out this version:
    $ git checkout v3.0.1

    • Adds new ci subcommand to run ADscan in CI pipelines with dedicated flags for automation
    • Changes group enumeration default strategy to BloodHound-first with LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. fallback for more consistent data
    • Enables automatic password extraction from spidering results and search descriptions when credential-like content is detected

    3 details in Everything

41. v2.2.1 Nov 15, 2025 · release notes

    adscan v2.2.1 adds automated BloodHound CE password rotation and isolated per-tool virtual environments.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.2.1 https://github.com/ADScanPro/adscan.git
    # already have the repo? check out this version:
    $ git checkout v2.2.1

    • Adds automated BloodHound CE password rotation during adscan install to remove manual prompts
    • Enforces per-tool isolated virtualenvs for all external dependencies to reduce conflicts

    2 details in Everything

42. v2.2.0 Nov 11, 2025 · release notes

    adscan v2.2.0 switches to BloodHound Community Edition; adscan install required

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.2.0 https://github.com/ADScanPro/adscan.git
    # already have the repo? check out this version:
    $ git checkout v2.2.0

    └──▷ TRY IT
    Install the new BHCE dependencies after upgrading.
    copy

    $ pipx upgrade adscan && adscan install

    Verify the installation and dependency state is correct.
    copy

    $ adscan check

    • Replaces legacy BloodHound with BloodHound Community Edition (BHCE) for collection/graph workflows.
    • adscan install is the mandatory post-upgrade command to fetch BHCE and update dependencies.

    2 details in Everything

43. v2.1.1 Jul 18, 2025 · release notes

    adscan v2.1.1 adds KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. authentication for flag collection and group-membership checks

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.1.1 https://github.com/ADScanPro/adscan.git
    # already have the repo? check out this version:
    $ git checkout v2.1.1

    • kerberos enum-users subcommand with a new custom wordlist for higher hit-rates on real names.

    1 detail in Everything

44. v2.1.0 Jul 10, 2025 · release notes

    adscan v2.1.0 adds Parrot OS support, ESC-4 auto-exploit, and KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. auth integration for key modules.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.1.0 https://github.com/ADScanPro/adscan.git
    # already have the repo? check out this version:
    $ git checkout v2.1.0

    • kerberoast, shadow_creds, and rdp_brute now support -k flag for auto-switching to Kerberos authentication when a valid TGT is present
    • New spray_same module enables identical user=password spraying without case variants for rapid internal CTFCTFCapture The Flag — a competitive hacking challenge format where participants exploit intentionally vulnerable systems or puzzles to retrieve hidden strings, used by cyber tools to practice and demonstrate offensive and defensive techniques. exploitation
    • Added ESC-4 auto-exploit path in ADCSADCSActive Directory Certificate Services, Microsoft's PKI role for issuing and managing X.509 certificates inside a Windows domain; cyber tools target it because misconfigurations frequently allow privilege escalation or domain compromise. scanning module
    • Parrot OS fully supported with automatic resolution of missing libraries and krb5 headers during installation

    4 details in Everything

45. v2.0.0 Jul 1, 2025 · release notes

    ADscan v2.0.0 introduces first public release with auto-pwn capabilities for Forest/Sauna/Arctic HTB boxes and semi/full-auto modes.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.0.0 https://github.com/ADScanPro/adscan.git
    # already have the repo? check out this version:
    $ git checkout v2.0.0

    • Adds auto=True or auto=False configuration options to enable full-auto exploitation chains or prompt-driven semi-auto flows
    • Introduces support for Forest, Sauna, and Arctic retired HTB boxes in the Lite edition's full-auto exploitation chain

    2 details in Everything