Workspace Management

Workspaces in ADscan allow you to organize and isolate scan data for different domains, networks, or projects. Each workspace maintains its own credentials, enumeration data, and logs.

Overview

Workspaces are stored in ~/.adscan/workspaces/ and contain:

• Discovered credentials
• Enumeration results (users, computers, groups, ACLs, GPOs, ADCS templates)
• The attack graph and the computed paths
• Scan logs and output
• The session's configuration

Commands

workspace create

Create a new workspace.

Syntax:

workspace create <name>

Example:

  (ADscan:client_audit_2024 ~/.adscan/workspaces/client_audit_2024) > workspace create client_audit_2024

  ✓ Workspace 'client_audit_2024' created

Naming Guidelines:

• Use descriptive names (domain name, client, date)
• No spaces (use underscores or hyphens)
• Keep names short and memorable

workspace select

Switch to an existing workspace. Selection is always interactive — select takes no name argument, it opens a picker over the workspaces on disk.

Syntax:

workspace select

  (ADscan:default ~/.adscan/workspaces/default) > workspace select

  ? Select workspace:
  > client_audit_2024
    htb_forest
    lab_testing

If no workspaces exist yet, select offers to create one instead of failing.

workspace list

List all available workspaces.

Syntax:

workspace list

Example Output:

  (ADscan:default ~/.adscan/workspaces/default) > workspace list

  Available Workspaces:
  ┌────────────────────┬─────────────────────┬───────────┐
  │ Name               │ Created             │ Size      │
  ├────────────────────┼─────────────────────┼───────────┤
  │ client_audit_2024  │ 2024-01-15 09:30    │ 45 MB     │
  │ htb_forest         │ 2024-01-10 14:22    │ 12 MB     │
  │ lab_testing        │ 2024-01-08 11:15    │ 8 MB      │
  └────────────────────┴─────────────────────┴───────────┘

workspace delete

Delete a workspace and all its data.

Syntax:

workspace delete <name>

Example:

  (ADscan:default ~/.adscan/workspaces/default) > workspace delete old_scan

  ⚠ This will permanently delete the workspace 'old_scan' and all its data
  ? Confirm deletion (y/n): y
  ✓ Workspace 'old_scan' deleted

Warning: This action is irreversible. All data in the workspace will be permanently deleted.

workspace show

Display details of the current workspace: its name and path, the session variables loaded from variables.json, and the first few files in the directory.

Syntax:

workspace show

  (ADscan:client_audit_2024 ~/.adscan/workspaces/client_audit_2024) > workspace show

  ╭─ Workspace: client_audit_2024 ─────────────────────────────╮
  │ Current Workspace Details                                  │
  │                                                            │
  │ Name: client_audit_2024                                    │
  │ Path: ~/.adscan/workspaces/client_audit_2024               │
  │                                                            │
  │ Associated Data (from variables.json):                     │
  │  Domain: corp.example.com                                  │
  │  Domains: ['corp.example.com']                             │
  │  Interface: eth0                                           │
  │  Myip: 192.168.1.44                                        │
  │  Auto mode: False                                          │
  │                                                            │
  │ Files in workspace directory (14 items):                   │
  │  - variables.json                                          │
  │  - technical_report.json                                   │
  │  - domains                                                 │
  │  - logs                                                    │
  │  - krb5.conf                                               │
  │  ...and 9 more.                                            │
  ╰────────────────────────────────────────────────────────────╯

With no workspace active it tells you so and points at workspace select.

workspace save

Flush the in-memory session state — variables and discovered credentials — to variables.json on disk.

Syntax:

workspace save

ADscan saves at the points that matter on its own, so you rarely need this. It is there for the case where you want the workspace on disk to match the session right now: before copying the directory elsewhere, before killing a long-running shell, or after adding credentials by hand. It is a no-op when no workspace is active.

clear_all

Clear all data from the current workspace.

Syntax:

clear_all

Example:

  (ADscan:client_audit_2024 ~/.adscan/workspaces/client_audit_2024) > clear_all

  ⚠ This will permanently delete all data in workspace 'client_audit_2024'
  ? Confirm deletion (y/n): y
  ✓ Workspace data cleared

Workspace structure

A workspace is one engagement container. It holds every domain you touched during that engagement, the service rollups across all hosts, and the artifacts each phase produced.

This is a real audit workspace after an authenticated scan of one domain, trimmed to the entries worth knowing about:

~/.adscan/workspaces/essos-audit/
├── variables.json                session state: domains, credentials, interface, config
├── technical_report.json         the structured finding set every report renders from
├── scope.json                    the scope this run was held to
├── environment_changes.json      ledger of directory changes ADscan made, and their rollback state
├── krb5.conf                     Kerberos config generated for the target realm
├── adscan_exposure_report_20260726-104233.html
├── adscan_exposure_report_20260726-104233.pdf
├── enabled_computers.txt         host rollups across every domain in the workspace
├── enabled_computers_ips.txt
├── deliverables/                 PRO kit: the ZIP, its manifest, the staged PDFs
├── cves/                         per-run CVE probe output
├── mitre/                        ATT&CK Navigator layers
├── logs/
│   ├── adscan.log
│   └── adscan.debug.log          always written at DEBUG, whatever verbosity you ran at
├── dns/ ftp/ http/ https/ kerberos/ ldap/ mssql/ rdp/ smb/ ssh/ vnc/ winrm/
│                                 one per enumerated service, each with an ips.txt of the
│                                 hosts that answered
└── domains/
    └── essos.local/
        ├── attack_graph.json             the graph, as a BloodHound-compatible export
        ├── attack_paths_snapshot.json    computed paths with their execution status
        ├── memberships.json              resolved group membership
        ├── identity_choke_points.json    the techniques that carry the most paths
        ├── identity_risk_snapshot.json
        ├── network_reachability_report.json
        ├── timeline.jsonl                what happened, in order
        ├── dcs.txt, enabled_users.txt, enabled_computers*.txt
        ├── variables.json                per-domain state
        ├── inventory/                    the collected directory as JSON: users, computers,
        │                                 groups, ous, acls, gpos, trusts, adcs_templates,
        │                                 dcsync_rights, domain_policy, …
        ├── adcs/                         certificates and tickets from ADCS abuse, by ESC id
        ├── cracking/                     hashes, and whatever cracked
        ├── kerberos/tickets/             ccaches, one per principal
        └── ldap/ smb/ nmap/ dns/ http/ rdp/ mssql/ winrm/
                                          per-domain logs for that service

Reading it:

• One workspace, one or many domains. A trust walk that discovers a child domain adds a second directory under domains/ rather than a second workspace.
• Top-level service folders are the global rollup across every host where that service answered. ips.txt lists them. An empty folder means the module ran and nothing answered.
• domains/<domain>/ is the per-domain view — the graph, the collected directory, and the artifacts of anything run against that domain.
• inventory/ is the raw collection, one JSON file per object class. attack_graph.json is what the path engine reads; inventory/ is what built it.
• A CTF workspace also carries flags/ with user.txt and root.txt.

Best Practices

Naming Conventions

Choose meaningful workspace names:

# Good examples
workspace create acme_corp_jan2024
workspace create htb_forest
workspace create client_pentest_phase1

# Avoid
workspace create test
workspace create ws1
workspace create temp

Workspace Organization

• One workspace per domain - Keep domains isolated
• Use dates - Include date in name for time tracking
• Client names - Use client codes for confidentiality

Backup Strategy

Back up workspace directories manually using system tools:

# Manual backup using tar
tar -czf ~/backups/workspace_$(date +%Y%m%d).tar.gz ~/.adscan/workspaces/client_audit_2024/

# Or use rsync for incremental backups
rsync -av ~/.adscan/workspaces/client_audit_2024/ ~/backups/workspaces/

Cleanup

Delete old workspaces to save disk space:

# List old workspaces
workspace list

# Delete completed assessments
workspace delete htb_forest

Workspace Permissions

Workspace files are stored with restrictive permissions:

• Directory: 700 (rwx------)
• Credentials: 600 (rw-------)
• Logs: 644 (rw-r--r--)

This ensures sensitive data is protected from other users on the system.

Troubleshooting

"Workspace already exists"

(ADscan) > workspace create test
✗ Workspace 'test' already exists

Solution: Choose a different name or delete the existing workspace.

The workspace you want is not in the picker

workspace select lists what is on disk under ~/.adscan/workspaces/. If a workspace is missing from the picker, confirm it exists with workspace list — a workspace created inside a container run that was not bind-mounted will not be there.

"Permission denied"

✗ Permission denied: ~/.adscan/workspaces/test

Solution: Ensure you have write permissions. If you previously ran ADscan with a legacy sudo alias, fix ownership:

sudo chown -R "$USER:$USER" ~/.adscan

Related

• Scanning commands — start scans within a workspace.
• adscan ci — unattended runs, and --keep-workspace.

Next Steps

After creating a workspace, proceed to:

1. Configure scanning parameters
2. Run your first scan