adscan ci

adscan ci runs the complete scan pipeline with no prompts. Every question that the interactive shell would ask resolves to a documented default, so the run either finishes or fails — it never sits waiting on stdin.

This is the entry point automation uses. The Enterprise appliance's worker and the ADscan platform both drive scans by shelling out to adscan ci; it is the same engine adscan start runs, with the operator decisions pre-resolved.

Usage

adscan ci {auth|unauth} --type {ctf|audit} --interface IFACE [options]

The launcher forwards everything after ci to the runtime inside the container, so adscan ci --help shows the full argument list from the runtime itself.

Required arguments

Then, depending on mode:

• auth needs --domain, --dc-ip, --username and --password.
• unauth needs --hosts (a CIDR or range), or --dc-ip to target a known DC and skip host discovery.

# Unauthenticated, against a known DC
adscan ci unauth --type audit --interface eth0 --dc-ip 10.0.0.1

# Authenticated
adscan ci auth --type audit --interface eth0 \
  --domain corp.local --dc-ip 10.0.0.1 \
  -u alice -p 'S3cr3t!'

--password accepts an NT hash as well as a cleartext password.

Segmented networks: a separate DNS server

On a segmented network the AD-zone DNS server is sometimes a different host from the domain controller. --dns-server IP covers that case: the DNS server resolves the domain zone, hostnames, and SRV records, while --dc-ip stays the authentication and enumeration target.

adscan ci unauth --type audit --interface eth0 \
  --dc-ip 10.0.0.1 --dns-server 10.0.9.53

The flag feeds only name resolution, including the Kerberos SPN lookup that keeps a scan on Kerberos instead of degrading to NTLM when a target only has an IP. When you omit it, ADscan resolves against --dc-ip exactly as before.

When a scan starts from a host range instead of a known DC and the controller does not answer DNS on port 53, ADscan detects a separate DNS server on the range on its own, and an unattended run adopts it only when it is the single such host and it actually resolves the domain zone. You do not need to pass --dns-server in that case unless you want to name the resolver explicitly.

What --type changes

Use audit for anything you will report on. A ctf run exits early by design, so its finding set is sparse.

The report

An audit run writes the exposure report on its own — HTML and PDF, into the workspace, with no flag. See The exposure report.

--generate-report is the PRO flag: it renders the Client Deliverable Kit through the same engine adscan deliver uses, inline at the end of the run.

--client-logo co-brands the cover with the client's logo beside the ADscan mark. It works on the exposure report an audit run writes on its own — so a LITE run co-brands with adscan ci --client-logo — as well as the PRO kit. It takes a PNG, SVG or JPG and is saved for later runs. Keeping the ADscan mark is the free behaviour; removing it for a fully white-labelled report is a paid capability.

Workspace

Keep the workspace if you intend to re-render deliverables later with adscan deliver, or to re-run a single path with adscan execute — both read data a scan already collected.

Output and diagnostics

Artifacts land in the workspace, not the working directory:

~/.adscan/workspaces/<workspace>/
├── technical_report.json
├── adscan_exposure_report_<timestamp>.html
├── adscan_exposure_report_<timestamp>.pdf
├── domains/<domain>/attack_graph.json
└── logs/adscan.debug.log

Under GitHub Actions (GITHUB_ACTIONS=true) the generated report is additionally copied into ./artifacts/ in the working directory, so a workflow can upload it without knowing the workspace path. Nothing is copied there on a normal run.

Exit codes

Behaviour that differs from an interactive run

• Prompts resolve to defaults. Every confirmation and selector answers itself with the conservative option and logs what it chose.
• Spray selection is deterministic. ADscan walks the priority order (user-as-password, then owned-credential reuse, then blank), skips anything already covered or with no eligible accounts, and stops. It cannot loop.
• Live dashboards collapse to plain lines. ci marks itself non-interactive, so the Rich live surfaces fall back to inline logging instead of writing alt-screen escapes into a captured log.
• The two optional telemetry questions never appear.

Launcher flags

These are consumed by the launcher on the host rather than forwarded to the scan, and appear in adscan --help:

adscan ci unauth --type audit --interface eth0 --dc-ip 10.0.0.1 \
  --offline           # refuse every outbound connection
  --no-telemetry      # keep the run local

--pull-timeout, --scan-config and --allow-low-memory are also launcher-side.

Related

• Scanning commands — what each phase does.
• execute & doctor — run one verb, or check the environment before committing to a scan.
• adscan deliver — render the deliverable kit from a workspace ci kept.