adscan — The Cyber Toolchain

adscan v13.2.0

Sat, 10 Oct 2026 21:13:08 GMT

adscan v13.2.0 adds local NT hash cracking with GPU support in CI, custom-branded deliverables, headless credential dumps, and three new ADCS findings.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `adscan execute compliance_scope` to declare an ENS scope (profile plus per-dimension security levels) so findings are scored against the client's actual regime rather than an assumed category; CCN-STIC 890A and 890C profiles use their own applicability tables.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `ADSCAN_NO_LOCAL_CRACKING=1` to opt out of local NT hash cracking; GPU cracking now works in `adscan ci` and `adscan execute`, not only in the interactive workbench, and runs against a time budget measured on your hardware. • Adds `adscan deliver --branding {adscan,cobrand,whitelabel}` together with `--client-cover`, `--client-back`, `--client-logo`, `--theme `, and `--emit data` (writes `report_model.json`) to produce co-branded, white-label, or stylesheet-customised deliverables including an HTML edition of the Security Assessment Report. • Adds `dump_lsa`, `dump_sam`, `dump_lsass`, `dump_dpapi`, `dump_registries`, and `dump_host` as subcommands of `adscan execute`, each accepting its own target and credentials, so credential dumps can run without the interactive workbench. • Adds `ADSCAN_NO_ESC15_CONFIRM=1` and `ADSCAN_NO_ESC9_CONFIRM=1` to skip the self-subject certificate issuance that now actively confirms ADCS ESC15, ESC9, and ESC10 findings instead of inferring them from template attributes. • Adds `ADSCAN_REPORT_CVSS_BASE=1` to print the CVSS Base score beside its vector for engagements that require it by contract; CVSS scores are otherwise removed from client deliverables. • Adds `--frameworks` as a required flag for `adscan ci --generate-report` on audit runs; the tool no longer defaults to ENS and refuses to render without an explicit framework choice. • Adds `--full-credentials` to `adscan writeup` to include the full recovered-credential table; the default audit output replaces secrets with their shape. • Adds `endpoint_defense_appendix.csv` to the Client Deliverable Kit, listing per-host antivirus and EDR posture, the credential-extraction techniques attempted, and their outcomes, and adds an AD Password Hygiene Report whenever credential recovery ran, covering recovery rate, coverage per privilege tier, and groups of accounts sharing a password. • Adds LDAP channel binding assessment over StartTLS when a domain controller firewalls LDAPS, so enforcement is now reported as Required or Not enforced instead of Unknown. Breaking changes: • `adscan ci --generate-report` no longer defaults to ENS on audit runs — it now requires `--frameworks` and refuses to render without it. • Client deliverables no longer include CVSS scores by default; set `ADSCAN_REPORT_CVSS_BASE=1` to restore the Base score beside its vector. • The lab writeup is no longer produced on any automatic audit path including `adscan ci`; run `adscan writeup` explicitly on an audit workspace to generate it. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/adscan

adscan v13.1.0

Fri, 25 Sep 2026 20:24:36 GMT

ADscan v13.1.0 adds honest ADCS outcome labeling, a 'Most Exposed Accounts' block, and Entra Connect sync-account Tier-0 classification.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • ADCS findings now report exactly one of three outcomes: validated (CA reachable and escalation completed end-to-end), data gap (weakness detected but CA unreachable, with the next step named), or directory hygiene (decommissioned CA still registered); an ESC8 finding additionally names the web-enrollment transport (HTTP or HTTPS) and the observed channel-binding state.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds a 'Most Exposed Accounts' block under the exposure headline in the report and platform, ranking accounts by number of compromise paths that reach them (and how many were validated end-to-end), to prioritize Protected Users membership, tiering, credential rotation, and LAPS. • Identifies Microsoft Entra Connect / MSOL_* directory-synchronization accounts holding directory-replication rights and classifies them as Tier-0 control-plane assets in the report, coverage report, and platform. • Attack-path listings in the exposure report now group fan-out routes that reach the same target via the same technique from different footholds into a single finding that names every foothold, reducing dozens of near-duplicate rows to a handful of findings. • Shadow Credentials (pre-existing msDS-KeyCredentialLink entries) are now presented as a persistence indicator rather than an active attack step; the operator panel groups and caps objects, surfaces Tier-0 assets first, and defaults the client finding to Medium severity (rising to higher severity only when the affected object is itself Tier-0). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/adscan

adscan v13.0.0

Sat, 19 Sep 2026 20:00:40 GMT

ADscan v13 adds zero-credential kill chains, LDAP anonymous bind detection, host credential-protection checks, CIS Benchmark mapping, and targeted attack-path queries via --target.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `--target` flag to the `attack_paths` command to query validated routes to one named group, host, or OU — resolves the name to its canonical graph label and lists closest matches on a miss.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `--no-update` as an alias for `--no-update-check` to suppress launcher and runtime version checks in offline/air-gapped runs. • Adds `graph_stats` command to display on-demand node/edge scale, control-hub density, and whether discovery will run in sampled mode; `adscan ci` prints a one-line version. • Adds `explain` command to render a full teaching card — MITRE ATT&CK mapping, by-hand command, detection events, native check, and remediation — for any technique in the coverage set. • Attack-path results now persist per workspace and are skipped on `--no-cache`; the cached set is invalidated automatically when the graph changes. • Zero-credential attack paths now begin at an explicit 'Unauthenticated (null session)' entry step, rated Critical when the chain reaches full domain compromise, so a zero-credential takeover no longer reports zero critical findings. • Adds 'LDAP Anonymous Bind Enabled' as a first-class finding with native remediation (disable anonymous operations via `dsHeuristics`, strip Anonymous Logon read grants) and a validation bind that should fail after remediation. • Adds six host-local credential-protection checks collected over the same session on hosts where the scan account is a local administrator: LSASS `RunAsPPL`, WDigest cleartext caching, LM hash storage, LAN Manager auth level, minimum NTLM session security, and custom Security Support Providers; each carries GPO/registry remediation and a `Get-ItemProperty` validation step. • Adds a configuration check for domains or fine-grained password policies that store passwords with reversible encryption, with native remediation and validation. • Compliance reports now support mapping to the CIS Microsoft Windows Server Benchmark alongside ENS, NIS2, ISO 27001, DORA, and PCI DSS, version-aware to each host's actual Windows release (Server 2016/2019/2022/2025, Windows 10/11). • The compliance scorecard now includes controls ADscan verified as correctly configured (conformant), not only broken ones; a control ADscan could not read stays 'not assessed' rather than assumed compliant. • Reports and the CLI now show which non-privileged accounts can reach a Tier-0 asset (domain controller, ADCS CA, Exchange server) and by what means: full local administrator, remote session, or database role. • Learning mode now teaches the full technique set it executes — ADCS ESC2 through ESC17, coercion/relay techniques (PetitPotam, PrinterBug, DFSCoerce, coerce-and-relay to ADCS), named CVEs (Zerologon, noPac, EternalBlue, PrintNightmare), lateral-movement, DCSync, secret-dump, ACL-abuse, delegation escalations, and MSSQL escalations — via full teaching cards before execution and on demand through the `explain` command. • Attack-path discovery now shows a pre-flight panel before running, displaying graph node/edge scale, control-hub density, and sampled-mode status. Breaking changes: • Python 3.9 is no longer supported; the minimum supported Python version is now 3.10. • `adscan ci` is now a PRO-only capability; LITE tier users must use the interactive `adscan start` workflow. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/adscan

adscan v13.0.0

Sat, 19 Sep 2026 20:00:40 GMT

ADscan v13 adds zero-credential kill chains, LDAP anonymous bind detection, host credential-protection checks, CIS Benchmark mapping, and targeted attack-path queries via --target.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `--target` flag to the `attack_paths` command to query validated routes to one named group, host, or OU — resolves the name to its canonical graph label and lists closest matches on a miss.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `--no-update` as an alias for `--no-update-check` to suppress launcher and runtime version checks in offline/air-gapped runs. • Adds `graph_stats` command to display on-demand node/edge scale, control-hub density, and whether discovery will run in sampled mode; `adscan ci` prints a one-line version. • Adds `explain` command to render a full teaching card — MITRE ATT&CK mapping, by-hand command, detection events, native check, and remediation — for any technique in the coverage set. • Attack-path results now persist per workspace and are skipped on `--no-cache`; the cached set is invalidated automatically when the graph changes. • Zero-credential attack paths now begin at an explicit 'Unauthenticated (null session)' entry step, rated Critical when the chain reaches full domain compromise, so a zero-credential takeover no longer reports zero critical findings. • Adds 'LDAP Anonymous Bind Enabled' as a first-class finding with native remediation (disable anonymous operations via `dsHeuristics`, strip Anonymous Logon read grants) and a validation bind that should fail after remediation. • Adds six host-local credential-protection checks collected over the same session on hosts where the scan account is a local administrator: LSASS `RunAsPPL`, WDigest cleartext caching, LM hash storage, LAN Manager auth level, minimum NTLM session security, and custom Security Support Providers; each carries GPO/registry remediation and a `Get-ItemProperty` validation step. • Adds a configuration check for domains or fine-grained password policies that store passwords with reversible encryption, with native remediation and validation. • Compliance reports now support mapping to the CIS Microsoft Windows Server Benchmark alongside ENS, NIS2, ISO 27001, DORA, and PCI DSS, version-aware to each host's actual Windows release (Server 2016/2019/2022/2025, Windows 10/11). • The compliance scorecard now includes controls ADscan verified as correctly configured (conformant), not only broken ones; a control ADscan could not read stays 'not assessed' rather than assumed compliant. • Reports and the CLI now show which non-privileged accounts can reach a Tier-0 asset (domain controller, ADCS CA, Exchange server) and by what means: full local administrator, remote session, or database role. • Learning mode now teaches the full technique set it executes — ADCS ESC2 through ESC17, coercion/relay techniques (PetitPotam, PrinterBug, DFSCoerce, coerce-and-relay to ADCS), named CVEs (Zerologon, noPac, EternalBlue, PrintNightmare), lateral-movement, DCSync, secret-dump, ACL-abuse, delegation escalations, and MSSQL escalations — via full teaching cards before execution and on demand through the `explain` command. • Attack-path discovery now shows a pre-flight panel before running, displaying graph node/edge scale, control-hub density, and sampled-mode status. Breaking changes: • Python 3.9 is no longer supported; the minimum supported Python version is now 3.10. • `adscan ci` is now a PRO-only capability; LITE tier users must use the interactive `adscan start` workflow. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/adscan

adscan v12.0.0

Tue, 08 Sep 2026 17:37:06 GMT

ADscan v12.0.0 adds native Windows support, in-process port scanning, CPU password cracking fallback, and smarter attack-path discovery for large AD environments. • Adds `ADSCAN_PORTSCAN_CONCURRENCY` and `ADSCAN_PORTSCAN_PER_HOST` environment variables to tune the new Windows in-process TCP connect port scanner. • Runs natively on Windows as a self-contained bundle — no Docker, no Python, no nmap, no Npcap required — allowing a low-privilege user on a domain-joined Windows host to run a full scan. • Adds in-process async TCP connect port scanning on Windows, replacing the nmap/Npcap dependency that hardened Windows hosts cannot satisfy. • Adds CPU fallback for password cracking (AS-REP and Kerberoast hashes) on Windows hosts with no OpenCL/CUDA runtime, with recovered credentials recorded the same way as GPU cracks. • Attack-path discovery now completes on very large, dense directories by switching to a bounded per-target search when the full analysis would exhaust available resources, covering every reachable high-value target. • Reports and the web platform now plainly declare when attack-path routes are a representative sample rather than the full set, and surface the stable 'exposure count' metric for tracking over time. • Domain-wide attack-path discovery now targets Tier-0 (high-value) assets only, with the CLI printing an honest note and listing those targets instead of silently launching an all-objects sweep that cannot finish on large directories. • Bulk DNS resolution no longer requires the external `massdns` binary, now resolving names concurrently through the DC — enabling host resolution on native Windows installs where `massdns` was unavailable. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/adscan

adscan v11.3.0

Tue, 01 Sep 2026 18:00:39 GMT

ADscan v11.3.0 adds cross-forest attack paths, didactic mode, seasonal password spraying, and krbtgt-only DCSync • Adds `set explain_level off|basic|deep` to control didactic mode verbosity, and `explain ` (e.g. `explain kerberoasting`, `explain "ADCS ESC1"`) to show a teaching card — with MITRE ATT&CK ID, equivalent manual command, and detection Event IDs — for any technique without executing it. • Adds `month_season` spray strategy to the scan config for seasonal password spraying (e.g. March2026, Verano2026), with per-domain language inference (English/Spanish) and last-password-change awareness when domain credentials are available; runs automatically in `adscan ci`. • DCSync now supports a 'krbtgt only' replication mode, capturing the golden-ticket key without pulling every account — the minimal-footprint path to proving full domain compromise. • Attack paths now cross domain and forest boundaries in multi-domain workspaces, analysed as a unified graph; includes cross-forest Kerberoasting, AS-REP Roasting, and ADCS ESC8/ESC11 relay routes across trusts. • Automated cross-forest escalation now ships two routes: from a compromised trusted forest into the trusting forest via cross-organization TGT-delegation trust, and from a compromised child domain up to its forest root (RaiseChild), each triggering post-compromise on the reached domain. • Plaintext credentials in account `description` or `info` LDAP attributes are now a validated, end-to-end attack step — ADscan reads the attribute, recovers the credential, verifies login, and traces the route across forest boundaries. • Reports and the web platform now include a 'Verify this finding independently' block per attack step with native Windows/PowerShell (`Get-ADUser`, `Get-Acl`, `dsacls`, `certutil`) and Linux equivalents pre-filled with the real DC IP and domain name, covering Kerberoasting, AS-REP Roasting, DCSync, ADCS ESC1, and the GenericAll/GenericWrite/WriteDACL/WriteOwner ACL family. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/adscan

adscan v11.3.0

Tue, 01 Sep 2026 18:00:39 GMT

adscan v11.3.0

Tue, 01 Sep 2026 18:00:39 GMT

adscan v11.3.0

Tue, 01 Sep 2026 18:00:39 GMT

adscan v11.2.0

Sun, 23 Aug 2026 10:35:59 GMT

adscan v11.2.0 adds `--dns-server` for segmented networks and auto-detects a separate DNS host during range discovery. • Adds `--dns-server` flag to `adscan ci`, `adscan execute`, and `adscan doctor` to direct all name resolution to a separate DNS host in segmented networks where the AD-zone DNS server is not the domain controller — covering domain and PDC-hostname discovery, SMB and ADCS CA name resolution, Kerberos SPN lookup, cross-forest trust resolution, and the network-preflight DNS check. `--dc-ip` remains the authentication and enumeration target; omitting `--dns-server` preserves existing behaviour. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/adscan

adscan v11.1.0

Mon, 10 Aug 2026 19:02:07 GMT

ADscan v11.1.0 adds cross-forest escalation chains, interactive SMB enrichment scoping, Tier 0 membership counts, and `ADSCAN_TRUST_SCOPE` trust-collection control. • Adds `ADSCAN_TRUST_SCOPE` environment variable (values: `all` or `origin`) to control which domains are collected across forest trusts, overridable per scan via the web scan-setup domain-enumeration policy. • Surfaces cross-forest Kerberos ticket delegation as an escalation route, drawing the two forests as one blast radius and adding remediation to disable the delegation. • Extends MSSQL linked-server-chain compromise across forest boundaries, coupling SYSTEM-on-DC to directory replication in the target trusted domain and terminating the attack path there rather than at the controller. • Adds an interactive SMB host-enrichment scope prompt on large directories, letting the operator choose between the recommended host set, a custom count, all hosts, or skipping enrichment entirely; reports and platform state how many hosts were enriched of the reachable total. • Reports and platform now show how many accounts already hold Tier 0 privilege by group membership alongside the count reachable via attack paths, with the already-privileged accounts excluded from the attack-path figure. • Trust relationships are now always mapped regardless of collection scope; domain collection follows engagement type — CTF scans collect all reachable domains including newly unlocked trusted forests unattended, while audit scans default to the origin domain. • Force Change Password steps now follow engagement type in unattended runs: CTF scans reset the target and continue automatically; audit scans skip the reset unless an operator explicitly approves it. Machine account password resets are refused outright in every mode. • MSSQL SYSTEM-escalation follow-up and HasSession exploitation steps now offer a choice between minting a fresh privileged account or elevating an account already under the operator's control. • HasSession escalation now elevates to the host's own local Administrators group on member servers instead of always adding to Domain Admins. • At workspace exit, ADscan prompts whether to delete any account it created during an MSSQL follow-up (default: yes); declining records the exact removal command so nothing is silently left behind. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/adscan

adscan v11.1.0

Mon, 10 Aug 2026 19:02:07 GMT

adscan v11.1.0

Mon, 10 Aug 2026 19:02:07 GMT

adscan v11.1.0

Mon, 10 Aug 2026 19:02:07 GMT

adscan v11.0.0

Mon, 03 Aug 2026 09:33:01 GMT

ADscan v11 adds ESC5 end-to-end exploitation, `generate_report`, `writeup`, client-logo delivery, and a MITRE-mapped COVERAGE.md • Adds `adscan deliver --client-logo` and `adscan ci --client-logo` flags accepting PNG, SVG, or JPG to embed a client logo in both the free and PRO report covers. • Adds `--no-telemetry` and `--offline` flags to `adscan start`; also restores `set telemetry off` as per-workspace and introduces `set telemetry off global` for an operator-wide default. • New `generate_report` command produces a free self-contained HTML and paginated A4 PDF exposure report from any scan; audit-mode scans run it automatically. • New `writeup` command captures port data, directory contents, the full attack chain as an editable Mermaid diagram, timestamped steps with credential provenance, flags, and dead ends into a lab/CTF writeup; runs automatically on lab and CTF scans. • Executes AD CS ESC5 end to end: backs up the CA private key, forges a certificate offline, and authenticates with it from the CA host's machine account or a recovered local-admin password. • New `COVERAGE.md` lists all 103 Active Directory techniques implemented, each mapped to MITRE ATT&CK and marked executed, detected, or declined for safety; generated from the product catalog so it cannot drift. • Service accounts carrying an HTTP SPN are now flagged as a Kerberos web-application relay and coercion surface, with native remediation guidance in the report and platform. • The Enterprise platform adds a cross-scan exposure comparison view that plots exposure across a workspace's scans and lists findings and attack paths that appeared, closed, or carried over. • Collapsed attack paths let the operator choose which interchangeable accounts to target — several at once for a roast or spray, one for a direct step — with unattended runs picking the strongest candidate automatically. • Attack paths with interchangeable intermediate accounts collapse into a single finding that names and counts those accounts, reducing report duplication. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/adscan

adscan v11.0.0

Mon, 03 Aug 2026 09:33:01 GMT

adscan v11.0.0

Mon, 03 Aug 2026 09:33:01 GMT

adscan v11.0.0

Mon, 03 Aug 2026 09:33:01 GMT

adscan v10.1.0

Sat, 25 Jul 2026 06:33:10 GMT

ADscan v10.1.0 adds SQL Server lateral movement, Shadow Credentials, GPO-to-code-execution chaining, and a new `adscan execute attack_paths` subcommand. • New `adscan execute attack_paths` subcommand runs a single saved attack path or step against a workspace without a full rescan; resolves credentials automatically for already-owned accounts and a companion re-arm resets step status to re-run a path. • REPL commands now accept flag-form arguments `-d`/`--dc-ip`/`-u`/`-p`/`--host`/`--service` alongside the existing positional form, with tab-completion for both flag names and values. • Adds SQL Server attack coverage: linked-server lateral movement across domain and forest trusts, automated command execution with escalation to SYSTEM, and arbitrary file read via bulk import — each surfaced as a validated attack step in the report. • Adds Shadow Credentials escalation: detects when it can write a key credential to a target account and executes the full authentication chain end to end. • Extended-rights escalation (forced password reset, DCSync, LAPS password read) is now modeled per target and chained into attack paths. • GPO control is now chained through to code execution via a scheduled task on machines the GPO applies to. • Adds credential capture through a pivot: NTLM authentication can be captured across a routed tunnel with per-target selection of the callback address. • Adds opt-in writable-share credential bait: plants a bait file on writable shares and captures resulting authentication attempts as a background job that does not block the scan; configurable via new scan-configuration toggles in the CLI and web console. • Certificate Services attacks now run through a native implementation, including detection of delegated CA-management rights and detection of Extended Protection on the web-enrollment endpoint (suppressing false ESC8 findings when enrollment is hardened). • Adds recovery of secrets protected with PowerShell `ConvertFrom-SecureString -Key`, chained into share-password findings. • Web ports 8080 and 8443 are now included in the important-ports sweep and folded into service discovery. • Attack paths now carry more precise result states: 'Partially Validated', 'Not Executed for Safety', and 'Attack Surface Reduced — Hardening Observed'. • The SQL Server post-authentication workflow now runs automatically in unattended scans instead of defaulting to skip. • The AD exposure score now combines proof strength with per-technique exploitability. • Remediation guidance is now written entirely in native Microsoft tooling (`dsacls`, RSAT Active Directory module, `Get-*`/`Set-*` cmdlets) with no third-party product names in client-facing report text. Breaking changes: • Nine REPL commands were renamed to native names; the previous command names are no longer accepted. • The 'Blocked by Active Controls' report category was removed. • Running the ADscan core directly on the host machine is now refused; the tool runs only inside its container. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/adscan

adscan v10.1.0

Sat, 25 Jul 2026 06:33:10 GMT

adscan v10.1.0

Sat, 25 Jul 2026 06:33:10 GMT

adscan v10.1.0

Sat, 25 Jul 2026 06:33:10 GMT

adscan v10.0.0

Thu, 16 Jul 2026 12:03:14 GMT

ADscan v10.0.0 adds integrated password cracking, broadcast poisoning capture, a `harvest` command, `jobs` command, resumable scans, and native macOS/ARM64 support. • Adds a `harvest` command providing a single view of every credential obtained during a scan (captured, cracked, and sprayed), each tagged with its privilege tier and reachable assets, plus an end-of-scan harvest summary. • Adds a `jobs` command to list, review, and stop long-running background tasks such as broadcast-name-resolution poisoning capture and password cracking. • Adds cracking-effort and poisoning controls to the YAML scan-config file and the web platform. • Adds password-strength auditing built into the scan: credentials captured via broadcast poisoning, Kerberos service tickets, and AS-REP hashes are cracked in the background using the bundled 94-million-entry 'ADscan AD Audit Wordlist' and a client-targeted wordlist generator, with recovered passwords fed back into the attack path automatically. • Adds a four-rung selectable cracking-effort ladder calibrated to host hardware, with accurate pre-commit time estimates and live progress/ETA during cracking. • Adds broadcast name-resolution poisoning capture (LLMNR, NBT-NS, mDNS) as a background task, surfaced as a finding and linked attack step, with an explicit consent panel in interactive mode and automatic start in unattended scans. • Adds Privilege Blast Radius: reports, the web platform, and the CLI now show the full set of assets and capabilities a single compromised account reaches. • Adds resumable scans — interrupted scans (crash, disconnect, or deliberate stop) can resume from the last completed phase or host; the web platform can stop and resume a running scan gracefully. • Adds native macOS and Apple Silicon support; LITE and PRO images are now published for ARM64/Apple Silicon in addition to x86-64. • Password spraying, share enumeration, SMB/LDAP hardening checks, local credential verification, and account cleanup now run on ADscan's built-in engine with consistent proxy support, removing the dependency on bundled external command-line tools. Breaking changes: • Bundled external third-party command-line cyber tools have been removed; any workflow that relied on them directly must now use ADscan's native engine equivalents. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/adscan

adscan v10.0.0

Thu, 16 Jul 2026 12:03:14 GMT

adscan v10.0.0

Thu, 16 Jul 2026 12:03:14 GMT

adscan v10.0.0

Thu, 16 Jul 2026 12:03:14 GMT

adscan v9.2.0

Tue, 23 Jun 2026 06:14:26 GMT

adscan v9.2.0 adds live web console, offline VM cred extraction, NIS2 framework, and MSSQL/AD Recycle Bin attack surfaces. • `Offline credential extraction` from virtual-machine artifacts (virtual disks, snapshots, differencing chains, memory images) left on shares • `MSSQL authorization mapping` adds SQL access and sysadmin rights to the attack graph as escalation paths • `Machine-password rotation auditing` recovers the real rotation interval and reports stale machine passwords • NIS2 is now a distinct, selectable `compliance framework` in the web platform • `Engagement-posture Settings` with independent Offline-mode and Send-telemetry toggles applied per scan Breaking changes: • Deliverables restructured into three documents: Security Assessment Report, AD Hardening Playbook, and AD Control Coverage Report; the standalone MITRE Remediation Checklist and Coverage Matrix deliverables are removed • Compliance frameworks are now opt-in instead of showing a fixed default set Full history on Cyber Toolchain: https://cybertoolchain.io/tools/adscan

adscan v9.1.1

Tue, 09 Jun 2026 10:04:07 GMT

ADscan v9.1.1 adds AD Exposure Score metric, proven credentials from writable shares, and faster PRO scans • `AD Exposure Score` added to executive summary, PDF hero, technical report JSON, and web dashboard trends. • New `Sample teaser report` profile for cold outreach. • `SMB Share Exposure` phase now captures credentials from writable shares via a planted lure. • `PRO` runs performance improved to match LITE (12-20x faster on large graphs). • Attack paths reaching full domain compromise are now ranked higher than foothold-only paths. • Unbound CI audit runs now capped at top 25 highest-risk shares with deep-analysis skipped by default. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/adscan

adscan v9.1.0

Thu, 04 Jun 2026 10:43:49 GMT

ADScan v9.1 adds SPN-jacking detection, NTLMv1 per-host sweep, MSSQL to DA escalation, and effective share access reporting. • `adscan` now detects and executes SPN-jacking with constrained delegation, modeling the attack graph in reports • Per-host NTLMv1 exposure sweep with live classification dashboard and compliance mappings (ENS, NIS2, DORA, ISO 27001, PCI DSS) • New `relay` command for NTLM-relay-to-LDAP workflow with resource-based delegation or Shadow Credentials • Passive credential capture via writable-share bait file with per-folder targeting and offline cracking • MSSQL service-account impersonation escalation to Domain Admin, including DC takeover options • SMB share enumeration reports effective access (share + NTFS permissions) instead of share-level only • Collection scope selector allows choosing sub-collections (directory/ACL base, local accounts, shares) at start • Live progress dashboard for SMB collection, Kerberos user enumeration, password spraying, and important-port scan Full history on Cyber Toolchain: https://cybertoolchain.io/tools/adscan

adscan v5.1.0

Tue, 03 Mar 2026 12:55:38 GMT

v5.1.0 adds Domain Admin Session attack step, caching, and improved cracking workflows • Added **Domain Admin Sessions** as a new attack step in attack path execution • Added attack path cache for faster attack path generation and better responsiveness • Improved local credential reuse logic for more accurate path generation Full history on Cyber Toolchain: https://cybertoolchain.io/tools/adscan

adscan v5.0.0

Thu, 26 Feb 2026 21:39:34 GMT

AdScan v5.0.0 adds AI integration to the shell workflow for analysis support. • Integrates AI directly in the adscan shell to speed up analysis and operator decision-making. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/adscan

adscan v4.1.2

Tue, 10 Feb 2026 13:17:39 GMT

adscan v4.1.2 adds workspace clear confirmation, improves CI logic and BloodHound ZIP efficiency • Added a confirmation prompt before clearing a workspace to prevent accidental data loss • Improved `adscan ci` logic for more robust non-interactive execution • Made ZIP upload to BloodHound more efficient Full history on Cyber Toolchain: https://cybertoolchain.io/tools/adscan

adscan v4.1.0

Mon, 02 Feb 2026 10:36:24 GMT

ADScan v4.1.0 adds DCSync fallback, WriteSPN exploitation, and Kerberos-first ADCS enumeration • `pypykatz` integration dumps hashes directly from `.DMP` files without leaving `adscan`. • `DCSync` fallback chain automatically tries `SAM`, `LSA`, and `DPAPI` dump when primary `DCSync` fails. • New attack path for `WriteSPN` ACL exploitation enables SPN manipulation. • ADCS enumeration and exploitation now defaults to Kerberos authentication via the new `Kerberos-first` logic. • `SeBackupPrivilege` privilege escalation changed from WinRM to SMB for broader compatibility. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/adscan

adscan v4.0.0

Mon, 26 Jan 2026 07:04:20 GMT

adscan v4.0 adds NTLM fallback, BloodHound CE attack path search, optional workspace cleanup, and changes BH CE port to 8443. • Added NTLM fallback when Kerberos fails • New attack path execution flow with step‑by‑step actions • Added BloodHound CE attack path search • Added optional workspace cleanup before scans • BloodHound CE default port changed from 8080 → 8443 Breaking changes: • BloodHound CE now listens on port 8443 instead of 8080 by default Full history on Cyber Toolchain: https://cybertoolchain.io/tools/adscan

adscan v3.1.4

Tue, 23 Dec 2025 13:16:53 GMT

ADScan v3.1.4 adds non-root execution default, `--fix` flag to `check`, and UDP->DNS TCP fallback • Adds `--fix` parameter to the `check` command to automatically fix detected issues • Adds DNS UDP→TCP fallback mechanism for improved network resilience • ADscan now exits when `apt update` fails instead of warning Breaking changes: • `apt update` errors now stop the process instead of warning Full history on Cyber Toolchain: https://cybertoolchain.io/tools/adscan

adscan v3.1.0

Sat, 13 Dec 2025 08:18:30 GMT

ADscan v3.1.0 adds automatic credential extraction from SMB descriptions and PSTranscripts, plus password-spraying re-use workflow • Adds `--extract-smb-desc` flag to automatically extract credentials from SMB share descriptions (including null session contexts) • Adds interactive prompt/flow to re-run password spraying with discovered passwords to identify additional users Full history on Cyber Toolchain: https://cybertoolchain.io/tools/adscan

adscan v3.0.1

Mon, 01 Dec 2025 11:29:58 GMT

ADScan v3.0.1 adds CI command, BloodHound-first enumeration, and automated credential extraction • Adds new `ci` subcommand to run ADscan in CI pipelines with dedicated flags for automation • Changes group enumeration default strategy to BloodHound-first with LDAP fallback for more consistent data • Enables automatic password extraction from spidering results and search descriptions when credential-like content is detected Full history on Cyber Toolchain: https://cybertoolchain.io/tools/adscan

adscan v2.2.1

Sat, 15 Nov 2025 12:16:04 GMT

adscan v2.2.1 adds automated BloodHound CE password rotation and isolated per-tool virtual environments. • Adds automated BloodHound CE password rotation during `adscan install` to remove manual prompts • Enforces per-tool isolated virtualenvs for all external dependencies to reduce conflicts Full history on Cyber Toolchain: https://cybertoolchain.io/tools/adscan

adscan v2.2.0

Tue, 11 Nov 2025 20:59:25 GMT

adscan v2.2.0 switches to BloodHound Community Edition; `adscan install` required • Replaces legacy BloodHound with **BloodHound Community Edition (BHCE)** for collection/graph workflows. • `adscan install` is the mandatory post-upgrade command to fetch BHCE and update dependencies. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/adscan

adscan v2.1.1

Fri, 18 Jul 2025 19:30:09 GMT

adscan v2.1.1 adds Kerberos authentication for flag collection and group-membership checks • `kerberos enum-users` subcommand with a new custom wordlist for higher hit-rates on real names. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/adscan

adscan v2.0.0

Tue, 01 Jul 2025 16:48:58 GMT

ADscan v2.0.0 introduces first public release with auto-pwn capabilities for Forest/Sauna/Arctic HTB boxes and semi/full-auto modes. • Adds `auto=True` or `auto=False` configuration options to enable full-auto exploitation chains or prompt-driven semi-auto flows • Introduces support for Forest, Sauna, and Arctic retired HTB boxes in the Lite edition's full-auto exploitation chain Full history on Cyber Toolchain: https://cybertoolchain.io/tools/adscan