Workflows and command shortcuts for scanning, credentials, and workspace-based evidence.

ADscan is a workflow tool: scan → discover attack steps → review attack paths → execute with operator control. This page gives you the shortest path to the commands that matter.

Core Pages

Workspace management

Keep credentials, artifacts, logs, and attack graphs isolated per engagement.

Scanning commands

Unauthenticated and authenticated enumeration, automation modes, and safe defaults.

adscan ci

Run the whole pipeline unattended — no prompts, safe defaults, one exit code.

execute & doctor

Run one verb non-interactively, and check the environment before committing to a scan.

Attack paths & steps

Find escalation chains from owned users to high-value targets and execute supported paths.

Credential management

View, select, and rotate discovered credentials without losing context.

adscan deliver

Render the PRO Client Deliverable Kit from a workspace a scan already filled.

AI assistant

Configure ask with an API provider, or with ChatGPT Plus/Pro via a Codex subscription.

Workspace Commands

Command	Description	Syntax
`workspace create`	Create a workspace and load it	`workspace create <name>`
`workspace list`	List all workspaces	`workspace list`
`workspace select`	Switch workspace (interactive picker)	`workspace select`
`workspace delete`	Delete a workspace	`workspace delete <name>`
`workspace show`	Show the current workspace's details	`workspace show`
`workspace save`	Flush session state to disk	`workspace save`
`clear_all`	Clear all data in the current workspace	`clear_all`

Configuration Commands

Command	Description	Syntax	Example
`set iface`	Set network interface	`set iface <interface>`	`set iface tun0`
`set hosts`	Set target IP range	`set hosts <cidr\|ip>`	`set hosts 10.10.10.0/24`
`set auto`	Set automation level	`set auto <True\|False>`	`set auto False`
`set telemetry`	Enable/disable telemetry	`set telemetry <on\|off>`	`set telemetry on`

Scanning Commands

Command	Description	Syntax
`start_unauth`	Start unauthenticated scan	`start_unauth [domain\|dc_ip] [dc_ip]`
`start_auth`	Start authenticated scan	`start_auth` or `start_auth <domain> <dc_ip> <user> <pass\|hash>`

Attack Graph Commands

Command	Description	Syntax
`attack_paths`	List and inspect attack paths	`attack_paths <domain> [user\|owned] [index] [--max N] [--depth N] [--all]`
`attack_steps`	List discovered attack steps	`attack_steps <domain> [user] [--max N]`

Credential Commands

Command	Description	Syntax
`creds show`	Display discovered credentials	`creds show`
`creds select`	Select credential for enumeration	`creds select <domain>`

System Command

Command	Description	Syntax
`system`	Execute local system command	`system <command>`

AI Assistant Commands

Command	Description	Syntax
`ask setup`	Configure AI backend/provider	`ask setup`
`ask status`	Show AI backend status	`ask status`
`ask doctor`	Validate AI runtime prerequisites	`ask doctor`
`ask login codex`	Sign in to Codex (ChatGPT Plus/Pro)	`ask login codex`
`ask auth-status codex`	Validate Codex authentication	`ask auth-status codex`
`ask logout codex`	Sign out from Codex	`ask logout codex`
`ask "<prompt>"`	Run one AI prompt	`ask "summarize findings"`
`ask`	Interactive AI mode	`ask`

Docker Mode Note

By default, ADscan runs inside a Docker container. That means system executes inside the ADscan container (with host networking), not directly on your host OS.

If you need to run host commands (for example docker ps), use a separate terminal on the host.

Common system commands:

system whoami                   # Container user
system ip addr show             # Network interfaces
system ping <ip>                # Test connectivity
system df -h                    # Disk space

Help Commands

Command	Description	Syntax
`help`	List all commands	`help`
`help <command>`	Get help for specific command	`help start_auth`
`exit`	Exit ADscan	`exit`

CLI Flags

Launch ADscan with these flags:

adscan start                 # Interactive workbench
adscan start -v              # Verbose
adscan ci auth  ...          # Unattended full scan — see /docs/commands/ci
adscan execute <verb> ...    # Run one REPL verb non-interactively
adscan doctor -d corp.local  # Pre-engagement health check
adscan deliver               # Render the PRO deliverable kit (PRO)
adscan install               # Pull the ADscan runtime image
adscan check                 # Verify Docker and the images are available
adscan update                # Pull the latest runtime image
adscan --version             # Show version
adscan --help                # Show help

Workflow Quick Start

Unauthenticated Scan

# Start ADscan
adscan start

Unauthenticated scan

  (ADscan:quickstart ~/.adscan/workspaces/quickstart) > workspace create quickstart_lab
  (ADscan:quickstart ~/.adscan/workspaces/quickstart) > set iface tun0
  (ADscan:quickstart ~/.adscan/workspaces/quickstart) > set hosts 10.10.10.0/24
  (ADscan:quickstart ~/.adscan/workspaces/quickstart) > set auto False
  (ADscan:quickstart ~/.adscan/workspaces/quickstart) > start_unauth

Authenticated Scan

# Start ADscan
adscan start

Authenticated scan

  (ADscan:quickstart ~/.adscan/workspaces/quickstart) > workspace create quickstart_auth
  (ADscan:quickstart ~/.adscan/workspaces/quickstart) > set iface tun0
  (ADscan:quickstart ~/.adscan/workspaces/quickstart) > set auto False
  (ADscan:quickstart ~/.adscan/workspaces/quickstart) > start_auth
  (ADscan:quickstart ~/.adscan/workspaces/quickstart) > attack_paths corp.local owned

start_auth will prompt you for credentials and the target context (domain/DC). If you already know everything, you can also run start_auth <domain> <dc_ip> <user> <pass|hash>.

Credential Management

Credential management

  (ADscan:quickstart ~/.adscan/workspaces/quickstart) > creds show
  (ADscan:quickstart ~/.adscan/workspaces/quickstart) > creds select corp.local

Using Discovered Credentials

Using discovered credentials

  (ADscan:quickstart ~/.adscan/workspaces/quickstart) > start_unauth # Discover credentials
  (ADscan:quickstart ~/.adscan/workspaces/quickstart) > creds show # View what was found
  (ADscan:quickstart ~/.adscan/workspaces/quickstart) > creds select corp.local # Pick credential
  (ADscan:quickstart ~/.adscan/workspaces/quickstart) > start_auth # Guided authenticated scan (recommended)
  (ADscan:quickstart ~/.adscan/workspaces/quickstart) > attack_paths corp.local owned # Review paths from owned users

Configuration Cheat Sheet

For Production/Client Engagements

set auto False               # Semi-automatic mode
set verbose True             # Detailed output
set telemetry off            # Disable if required

For Labs/CTFs

set auto True                # Automatic mode (safe actions auto-run)
set verbose True             # See what's happening

Network Configuration

# Find your interface
system ip addr show

# Common interfaces
set iface eth0               # Ethernet
set iface tun0               # VPN (HTB, VulnHub)
set iface wlan0              # WiFi

Use auto=False as the default in production environments. auto=True is optimized for labs and testing: it runs low-risk steps automatically but still asks for confirmation before noisy, disruptive, or out-of-scope operations.

File Locations

~/.adscan/workspaces/<workspace>/
├── variables.json                       session state: domains, credentials, services, config
├── technical_report.json                the structured finding set reports render from
├── environment_changes.json             ledger of directory changes, and their rollback state
├── enabled_computers.txt                host rollups across every domain
├── adscan_exposure_report_<stamp>.html  the exposure report (audit workspaces)
├── adscan_exposure_report_<stamp>.pdf
├── deliverables/                        the PRO kit (PRO only)
├── logs/adscan.debug.log                always DEBUG on disk
└── domains/<domain>/
    ├── attack_graph.json                the graph, BloodHound-compatible
    ├── attack_paths_snapshot.json       computed paths and their status
    ├── inventory/                       users, computers, groups, acls, gpos, adcs_templates, …
    └── kerberos/tickets/                ccaches, one per principal

The full annotated layout is on the workspace page. User configuration lives at ~/.adscan/config.json.

Attack-Path Analysis

ADscan's native graph collector runs as part of every authenticated scan and writes a BloodHound-compatible export per domain. Three ways to consume it:

# Inspect paths directly from the ADscan CLI
attack_paths <domain> owned
attack_paths <domain> owned --tier0-only
attack_paths <domain> owned --lowpriv

# Or load the JSON into your own BloodHound CE instance
# Path: ~/.adscan/workspaces/<ws>/domains/<domain>/attack_graph.json

No bundled BloodHound CE

Earlier releases bundled a managed BloodHound CE container stack. ADscan now ships a native LDAP graph collector that produces the same BloodHound-compatible JSON without a Docker Compose stack or a separate web UI.

If you want the graph UI, run your own BloodHound CE instance and upload the JSON through its Upload Data action. The ADscan runtime never talks to it — the export is the only handoff.

Common Workflows

1. CTF Auto-Pwn

adscan start
workspace create htb_forest
set iface tun0
set auto True
set hosts 10.10.10.161
start_unauth
# ADscan automatically discovers, cracks, and escalates

2. Client Pentest (Conservative)

adscan start
workspace create client_jan2024
set iface eth0
set auto False
set hosts 192.168.1.0/24
start_unauth
# Review findings, then:
creds show
creds select corp.local
start_auth corp.local 192.168.1.10 user password

3. Credential Testing

workspace create cred_test
set iface eth0
set auto False
start_auth corp.local 10.0.0.1 testuser TestPass123
# Enumerate access and privileges

Tips and Tricks

Check VPN Before Scanning

system ping <target_ip>
system ip addr show | grep tun0

Monitor Scan Progress

# In another terminal
tail -f ~/.adscan/logs/adscan.log

View Workspace Files

# On the host (separate terminal)
ls -la ~/.adscan/workspaces/<workspace>/

Backup Workspace

# On the host (separate terminal)
tar -czf backup.tar.gz ~/.adscan/workspaces/<workspace>/

Inspect Attack-Path Export

# On the host (separate terminal)
ls -la ~/.adscan/workspaces/<workspace>/domains/<domain>/attack_graph.json
# Then load that file into your own BloodHound CE instance if you want the graph UI

Troubleshooting Quick Reference

Issue	Quick Fix
Docker not running	`sudo systemctl start docker`
Interface not found	`system ip addr show` to find correct interface
Authentication failed	Verify the credential with `adscan doctor -d <domain> --dc-ip <ip> -u <user> -p <pass>`
Attack-path graph missing for domain	Re-run `start_auth` with a credential that has LDAP read access
Out of disk space	Delete old workspaces or use `clear_all`

For detailed troubleshooting, see the Troubleshooting Guide.

Mode	Description	Use Case	Prompts
`auto=False`	Semi-automatic	Production, client engagements	Before each risky operation
`auto=True`	Automatic (safe-first)	Labs, CTFs, testing	Minimal, still confirms high-impact actions

Command Reference

Workspace management

Scanning commands

adscan ci

execute & doctor

Attack paths & steps

Credential management

adscan deliver

AI assistant

On this page