Active Directory exposure management — from assessment to client deliverable in one command.

ADscan

Active Directory exposure management for pentesters, MSSPs, and CISOs.

One command runs the assessment. Another delivers four client-ready PDFs. No tool-hopping.

Current version: 9.1.1 LITE

Three tiers

Tier	What it is	Who uses it
LITE	Free CLI engine — community-maintained scan core	Pentesters, red teamers, students
PRO	LITE + Client Deliverable Kit (4 PDFs + ZIP)	MSSPs, consultancies billing engagements
Enterprise	Continuous CTEM/BAS web service with weekly digest	CISOs operating their own AD posture

LITE quickstart — install, scan, attack-paths in under 10 minutes.

PRO setup — generate the Client Deliverable Kit in 90 seconds.

Architecture, deployment model, and what the kit looks like.

Active Directory enumeration — DNS, LDAP, SMB, Kerberos, ADCS, trust spidering, native graph collection.
Attack execution — Kerberoasting, AS-REP roasting, ACL abuse, GPP, GPO abuse, constrained-delegation SPN-jacking (SPNJack), DCSync, ADCS ESC1-16.
Client Deliverable Kit (PRO) — Executive Assessment Report, AD Hardening Playbook, MITRE Remediation Checklist, Coverage Matrix — generated in 90 seconds with adscan deliver.