Quick Start

This guide walks you through your first scan with ADscan in less than 5 minutes.

Prerequisites

Make sure you have:

• ✅ ADscan installed (Installation guide)
• ✅ Dependencies installed (adscan install)
• ✅ Root/sudo access
• ✅ Network access to target domain

Step 1: Start ADscan

Launch the interactive TUI:

adscan start

You'll see the ADscan prompt:

(ADscan) >

Enable Verbose Mode (Optional)

For more detailed output during your first scan:

adscan start -v
# or
adscan start --verbose

Step 2: Create a Workspace

Workspaces keep your scan data organized. Create one for your target:

(ADscan) > workspace create my_first_scan

Your prompt will change to show the active workspace:

(ADscan:my_first_scan) >

Step 3: Configure Network Interface

Set your network interface (e.g., eth0, tun0 for VPN):

(ADscan:my_first_scan) > set iface tun0

Step 4: Choose Automation Level

ADscan offers two modes:

• Semi-automatic (auto=False) - Prompts for each action (recommended for production)
• Automatic (auto=True) - Faster, minimal prompts (good for labs/CTFs)

For your first scan, use semi-automatic mode:

(ADscan:my_first_scan) > set auto False

Step 5: Run Your First Scan

Option A: Unauthenticated Scan

Start with an unauthenticated scan to discover targets:

# Set target range
(ADscan:my_first_scan) > set hosts 10.10.10.0/24

# Start unauthenticated scan
(ADscan:my_first_scan) > start_unauth

ADscan will:

1. Discover Active Directory domain controllers
2. Enumerate users and computers
3. Perform anonymous LDAP queries
4. Extract useful information without credentials

Option B: Authenticated Scan

If you have credentials, start with an authenticated scan:

(ADscan:my_first_scan) > start_auth example.local 10.10.10.1 username password

ADscan will:

1. Verify credentials
2. Enumerate domain users, groups, and computers
3. Check for common vulnerabilities
4. Perform Kerberoasting and AS-REP roasting
5. Collect BloodHound data
6. Suggest next steps

Step 6: Follow Interactive Prompts

ADscan will guide you through the enumeration and exploitation process:

• Green prompts: Safe enumeration actions
• Yellow warnings: Potentially noisy operations
• Red confirmations: Disruptive actions (always require explicit confirmation)

Example interactive flow:

[?] AS-REP roastable accounts found. Attempt to crack hashes? (y/n):
[?] Kerberoastable accounts discovered. Perform Kerberoasting? (y/n):
[?] Credentials found! Attempt credential spraying? (y/n):

Step 7: View Results

ADscan stores all results in your workspace directory:

ls ~/.adscan/workspaces/my_first_scan/

You'll find:

• credentials.json - Discovered credentials
• users.txt - Domain users
• computers.txt - Domain computers
• bloodhound/ - BloodHound collection data
• logs/ - Scan logs

Example: Complete CTF Scan

Here's a complete example for a CTF box:

# Start ADscan
adscan start -v

# Create workspace
(ADscan) > workspace create htb_forest
(ADscan:htb_forest) >

# Configure
(ADscan:htb_forest) > set iface tun0
(ADscan:htb_forest) > set auto True

# Set target
(ADscan:htb_forest) > set hosts 10.10.10.161

# Run unauthenticated scan
(ADscan:htb_forest) > start_unauth

# ADscan will automatically:
# - Discover domain (htb.local)
# - Find AS-REP roastable accounts
# - Crack hashes
# - Authenticate with found credentials
# - Escalate to Domain Admin
# - Dump credentials

For the HTB Forest machine, this process takes ~3 minutes in automatic mode.

Next Steps

Now that you've completed your first scan:

• 📚 Learn about workspace management
• 🔍 Explore scanning commands
• 🔍 Manage credentials
• 🎯 Follow a CTF walkthrough

Getting Help

Within the ADscan shell, you can always get help:

# List all commands
(ADscan:workspace) > help

# Get help for specific command
(ADscan:workspace) > help start_auth

Community Support

Need help? Join our community:

• Discord: discord.com/invite/fXBR3P8H74
• GitHub Issues: github.com/ADscanPro/adscan/issues