How does ADscan reduce AD pentest time from 5 days to 2?

ADscan automates enumeration (saves 1-2 days), provides semi-guided exploitation paths (saves 1-2 days), and generates MITRE-mapped reports automatically (saves 0.5-1 day). The operator confirms all actions while ADscan handles the grunt work.

What's the difference between ADscan and PingCastle/Purple Knight?

PingCastle and Purple Knight are excellent risk assessment tools for IT teams. ADscan goes further by executing semi-guided exploitation, building complete attack chains, and outputting pentester-ready MITRE-mapped evidence for consulting deliverables.

How is ADscan different from Pentera?

Pentera is a GUI-based automated platform designed for IT teams to run simulations. ADscan is a CLI tool built for pentesters who need granular control over attack vectors, reproducible evidence, and detailed technical reporting for client deliverables.

Does ADscan work in air-gapped environments?

Yes. ADscan supports offline licenses and includes an optional on-premises license server for completely air-gapped deployments. All tools and wordlists are bundled locally.

What operating systems does ADscan support?

Currently Linux (Kali, Ubuntu, Debian, Parrot). Docker and Windows support are in the near-term roadmap. Design Partners get early access to new platform releases.

Can ADscan integrate with existing pentest workflows?

Yes. ADscan exports to JSON for integration with other tools, generates Word reports using your templates, and works alongside BloodHound, NetExec, and other standard AD pentest tools.

How much does ADscan cost for consulting companies?

PRO seats start at €997/year. Enterprise team packs (5/10/25 seats) include volume discounts, SSO, and priority support. POV Pass available at €249 per 14-day engagement for project-based testing.

What's included in the 14-day POV?

Full ADscan PRO features, setup assistance, Word report generation, and a debrief session with your team lead. No credit card required. Run in your non-production lab environment.

What is the difference between a POV and the Design Partner program?

POV is a 14-day lab evaluation to validate fit. Design Partner is a 90-day collaboration with direct support, early features and limited discounted pricing in exchange for an anonymous/public case.

Workspace Management

Workspaces in ADscan allow you to organize and isolate scan data for different domains, networks, or projects. Each workspace maintains its own credentials, enumeration data, and logs.

Overview

Workspaces are stored in ~/.adscan/workspaces/ and contain:

Discovered credentials
Enumeration results (users, computers, groups)
BloodHound collection data
Scan logs and output
Configuration settings

Commands

`workspace create`

Create a new workspace.

Syntax:

workspace create <name>

Example:

(ADscan) > workspace create client_audit_2024
✓ Workspace 'client_audit_2024' created
(ADscan:client_audit_2024) >

Naming Guidelines:

Use descriptive names (domain name, client, date)
No spaces (use underscores or hyphens)
Keep names short and memorable

`workspace select`

Switch to an existing workspace.

Syntax:

workspace select [name]

Interactive Mode:

(ADscan) > workspace select
? Select workspace:
  > client_audit_2024
    htb_forest
    lab_testing

Direct Selection:

(ADscan) > workspace select htb_forest
✓ Switched to workspace 'htb_forest'
(ADscan:htb_forest) >

`workspace list`

List all available workspaces.

Syntax:

workspace list

Example Output:

(ADscan) > workspace list

Available Workspaces:
┌────────────────────┬─────────────────────┬───────────┐
│ Name               │ Created             │ Size      │
├────────────────────┼─────────────────────┼───────────┤
│ client_audit_2024  │ 2024-01-15 09:30    │ 45 MB     │
│ htb_forest         │ 2024-01-10 14:22    │ 12 MB     │
│ lab_testing        │ 2024-01-08 11:15    │ 8 MB      │
└────────────────────┴─────────────────────┴───────────┘

`workspace delete`

Delete a workspace and all its data.

Syntax:

workspace delete <name>

Example:

(ADscan) > workspace delete old_scan
⚠ This will permanently delete the workspace 'old_scan' and all its data
? Confirm deletion (y/n): y
✓ Workspace 'old_scan' deleted

Warning: This action is irreversible. All data in the workspace will be permanently deleted.

`workspace info`

Display information about the current workspace.

Syntax:

workspace info

Example Output:

(ADscan:client_audit_2024) > workspace info

Workspace: client_audit_2024
───────────────────────────────────────────
Path:        ~/.adscan/workspaces/client_audit_2024
Created:     2024-01-15 09:30:45
Size:        45 MB
Domain:      corp.example.com
Credentials: 12 accounts
Users:       450 discovered
Computers:   125 discovered
BloodHound:  Data collected

`clear_all`

Clear all data from the current workspace.

Syntax:

clear_all

Example:

(ADscan:client_audit_2024) > clear_all
⚠ This will permanently delete all data in workspace 'client_audit_2024'
? Confirm deletion (y/n): y
✓ Workspace data cleared

# TODO: Add real output from 'clear_all' command

Warning: This action removes all enumeration data, credentials, logs, and BloodHound collections from the workspace. The workspace directory structure remains but is empty.

Destructive Operation

clear_all permanently deletes all data in the workspace including discovered credentials, enumeration results, and BloodHound collections. Always backup important data before using this command. This action cannot be undone.

Workspace Structure

Each workspace has the following structure:

~/.adscan/workspaces/<workspace_name>/
├── credentials.json       # Discovered credentials
├── domain_info.json       # Domain metadata
├── users.txt              # Enumerated users
├── computers.txt          # Enumerated computers
├── groups.txt             # Enumerated groups
├── bloodhound/            # BloodHound data
│   ├── computers.json
│   ├── users.json
│   ├── groups.json
│   └── domains.json
├── shares/                # Share enumeration
│   └── accessible_shares.txt
├── passwords/             # Extracted passwords
│   └── found_passwords.txt
└── logs/                  # Scan logs
    ├── enumeration.log
    └── exploitation.log

Best Practices

Naming Conventions

Choose meaningful workspace names:

# Good examples
workspace create acme_corp_jan2024
workspace create htb_forest
workspace create client_pentest_phase1

# Avoid
workspace create test
workspace create ws1
workspace create temp

Workspace Organization

One workspace per domain - Keep domains isolated
Use dates - Include date in name for time tracking
Client names - Use client codes for confidentiality

Backup Strategy

Back up workspace directories manually using system tools:

# Manual backup using tar
tar -czf ~/backups/workspace_$(date +%Y%m%d).tar.gz ~/.adscan/workspaces/client_audit_2024/

# Or use rsync for incremental backups
rsync -av ~/.adscan/workspaces/client_audit_2024/ ~/backups/workspaces/

Cleanup

Delete old workspaces to save disk space:

# List old workspaces
workspace list

# Delete completed assessments
workspace delete htb_forest

Workspace Permissions

Workspace files are stored with restrictive permissions:

Directory: 700 (rwx------)
Credentials: 600 (rw-------)
Logs: 644 (rw-r--r--)

This ensures sensitive data is protected from other users on the system.

Troubleshooting

"Workspace already exists"

(ADscan) > workspace create test
✗ Workspace 'test' already exists

Solution: Choose a different name or delete the existing workspace.

"Workspace not found"

(ADscan) > workspace select nonexistent
✗ Workspace 'nonexistent' not found

Solution: Check available workspaces with workspace list.

"Permission denied"

✗ Permission denied: ~/.adscan/workspaces/test

Solution: Ensure you have write permissions or run with sudo.

Scanning Commands - Start scans within workspaces

Next Steps

After creating a workspace, proceed to:

Workspace Management

On this page