Command Reference

# With password
start_auth <domain> <dc_ip> <username> <password>

# With NTLM hash
start_auth <domain> <dc_ip> <username> <ntlm_hash>

# Examples
start_auth corp.local 10.10.10.1 jdoe Password123
start_auth htb.local 10.10.10.161 svc-alfresco s3rvice
start_auth example.local 10.0.0.1 admin aad3b435b51404eeaad3b435b51404ee:hash

system whoami                    # Local user
system ip addr show             # Network interfaces
system ping <ip>                # Test connectivity
system ls ~/.adscan/workspaces/ # List workspaces
system df -h                    # Disk space
system docker ps                # BloodHound status

adscan start                 # Start interactive TUI
adscan start -v              # Start with verbose mode
adscan start --verbose       # Same as -v
adscan start --debug         # Start with debug mode
adscan install               # Install dependencies
adscan check                 # Check installation status
adscan --version             # Show version
adscan --help                # Show help

adscan start -v
workspace create <name>
set iface tun0
set hosts 10.10.10.0/24
set auto False
start_unauth

adscan start -v
workspace create <name>
set iface tun0
set auto False
start_auth <domain> <dc_ip> <user> <pass>

creds show                   # View all credentials
creds select <domain>        # Select credential
# ADscan enumerates with selected credential

# After discovering credentials in unauthenticated scan
start_unauth                 # Discovers credentials
creds show                   # View what was found
creds select <domain>        # Pick credential
start_auth ...               # Enumerate as that user

set auto False               # Semi-automatic mode
set verbose True             # Detailed output
set telemetry off            # Disable if required

set auto True                # Automatic mode
set verbose True             # See what's happening

# Find your interface
system ip addr show

# Common interfaces
set iface eth0               # Ethernet
set iface tun0               # VPN (HTB, VulnHub)
set iface wlan0              # WiFi

~/.adscan/workspaces/<workspace>/
├── credentials.json          # Discovered credentials
├── users.txt                 # Domain users
├── computers.txt             # Domain computers
├── bloodhound/               # BloodHound data
└── logs/                     # Scan logs

~/.adscan/logs/adscan.log     # Main log file

~/.adscan/config.json         # User configuration
~/.adscan/tools/              # Installed tools

# BloodHound CE runs on
http://localhost:8080

# Default credentials (set during adscan install)
# Username: admin
# Password: <set during installation>

# Data is auto-uploaded during scans
# Access BloodHound to view attack paths

adscan start -v
workspace create htb_forest
set iface tun0
set auto True
set hosts 10.10.10.161
start_unauth
# ADscan automatically discovers, cracks, and escalates

adscan start -v
workspace create client_jan2024
set iface eth0
set auto False
set hosts 192.168.1.0/24
start_unauth
# Review findings, then:
creds show
creds select corp.local
start_auth corp.local 192.168.1.10 user password

workspace create cred_test
set iface eth0
set auto False
start_auth corp.local 10.0.0.1 testuser TestPass123
# Enumerate access and privileges

system ping <target_ip>
system ip addr show | grep tun0

# In another terminal
tail -f ~/.adscan/logs/adscan.log

system ls -la ~/.adscan/workspaces/<workspace>/

system tar -czf backup.tar.gz ~/.adscan/workspaces/<workspace>/

system docker ps | grep bloodhound
system docker logs bloodhound