Stop Wasting 30–60 Minutes Per Lab on DNS, Tooling and Copy/Paste

The Problem Every AD Pentester Knows

You connect to a fresh HTB lab. The environment is ready. You know the attack path.

But before you can start the real work:

• 15–20 minutes configuring DNS, NTP sync, VPN routes, and tooling
• 10–15 minutes copy/pasting between a graph tool, a protocol swiss-army knife, an ADCS tool, and your notes
• 5–10 minutes manually chaining credentials, re-typing queries, managing evidence

30–60 minutes of plumbing work before you even start exploiting the actual AD weaknesses.

ADscan LITE: From “Fresh Lab” to “Full Domain Compromise” in 2–5 Minutes

ADscan LITE orchestrates the boring parts so you can focus on learning real attack paths and building repeatable mental models.

Proven Speed on Real Labs

Getting Started with Labs

Individual pentesters (learning AD attacks)

Use these walkthroughs to learn the chain, then repeat it faster with a clean, logged workflow.

Install ADscan LITE or view the GitHub repo

About These Walkthroughs

These walkthroughs demonstrate how ADscan can automatically compromise retired CTF machines and intentionally vulnerable labs. Each guide includes:

• Complete attack chain breakdown
• Automated ADscan approach vs manual techniques
• Security lessons and detection opportunities
• Template outputs for you to fill with real data

Hack The Box Labs

Difficulty Levels

Easy

• HTB Forest - Perfect introduction to automated AD pentesting
• HTB Active - Classic GPP and Kerberoasting attacks
• HTB Cicada - Guest HR share spidering, password spraying, and DCSync chaining

Medium

• More labs coming soon

Attack Techniques Covered

Initial Access

• AS-REP Roasting - Forest
• GPP Password Extraction - Active
• Guest SMB + HR Share Spidering - Cicada

Credential Access

• Kerberoasting - Active
• LDAP Attributes / Descriptions - Cicada
• Password Spraying Chains - Cicada

Privilege Escalation

• WriteDacl Abuse - Forest
• DCSync Attack - Forest
• Pass-the-Hash - Active

After you own the box: writeup

The gap between owning a lab and publishing the writeup is usually months — these platforms hold back publication until the target retires. What you lose in that gap is not the exploit, it is the order: which credential came from which technique, what you tried that went nowhere, what the graph actually held at each stage. None of that is in your shell history.

writeup records it while it is still on disk:

(ADscan:htb_forest) > writeup

It writes a Markdown draft under <workspace>/writeups/<slug>-<timestamp>/writeup.md, in the section order the genre already uses: target, recon, enumeration, one section per stage of the chain with each step's outcome and a public reference for the technique, the credentials with their provenance, the flags, the dead ends, and a mermaid diagram of the chain.

It writes no prose. Every place a paragraph belongs carries a marker instead of a generated sentence, and the panel tells you how many are left. That is deliberate: the paragraphs are the reason a writeup is worth reading and worth your name on it, and a machine writing them produces exactly the register this community recognizes and dislikes. The transcript is mechanical; the analysis is yours.

The draft is local and carries draft: true / published: false in its frontmatter, which Hugo and Jekyll both honour, so it cannot be built into a site by accident. Nothing is uploaded.

Using These Walkthroughs

For Learners

1. Set up the lab environment (VPN to HTB network)
2. Follow the walkthrough with ADscan in automatic mode
3. Review the attack chain breakdown to understand what happened
4. Try manual mode to make decisions at each step
5. Study the manual equivalent commands to learn traditional techniques

For Practitioners

• Use as reference for penetration testing techniques
• Understand how ADscan automates complex attack chains
• Learn detection opportunities for defensive security
• Compare manual vs automated approach timings

For CTF Players

• Speed run retired machines with ADscan
• Verify your manual approach against automated paths
• Practice for OSCP/CRTP style exams
• Share your times in the ADscan community

Prerequisites

All labs require:

• ADscan installed and configured
• Active VPN connection to CTF network
• Network interface configured (typically tun0)

See Installation Guide for setup instructions.

Contributing

Have you auto-pwned a machine with ADscan? Share your walkthrough:

1. Join ADscan Discord
2. Share your attack timeline and output
3. Help expand the lab collection

Legal Notice

All labs and machines featured are:

• Retired from active CTF platforms
• Intended for educational purposes
• Authorized for testing by platform owners

Never use these techniques on systems without explicit authorization.

Next Steps