adscan

Sequence available Active Directory pentest tools into minimal viable workflows.

Updated Aug 23, 2026
One-click install
npx skills add https://github.com/0X6C7879/aegissec --skill adscan
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: adscan
Source: https://github.com/0X6C7879/aegissec/tree/main/skills/adscan
Command: npx skills add https://github.com/0X6C7879/aegissec --skill adscan

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

Replaces ad-hoc tool chaining with a centralized orchestrator that sequences available AD pentest tooling to reproduce ADscan-like workflows, saving time and reducing manual coordination.

Core Features & Use Cases

  • Centralized orchestration of the AD pentest toolchain (NetExec, Impacket, BloodHound, Certipy, Responder, hashcat, Kerbrute, SMBMap, Snaffler) to reproduce ADscan-like workflows.
  • Supports discovery, credential validation, BloodHound collection, AD CS checks, SMB share analysis, relay/cracking workflows, and structured evidence logging for reproducibility.
  • Example: Given a local toolset, generate a minimal viable engagement flow that enumerates domain users and derives lineage paths while recording commands and outputs for auditing.

Quick Start

Run the adscan skill in a per-engagement workspace to detect locally available AD pentest tooling and initialize the smallest viable discovery workflow.

Frequently Asked Questions about adscan

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I orchestrate Active Directory pentest workflows without a monolithic scanner?

AD pentest orchestration sequences available local tooling like NetExec, Impacket, and BloodHound to reproduce ADscan-like workflows. It maps discovered tools and composes a minimal viable workflow, replacing ad-hoc manual chaining with centralized coordination.

What is the best way to chain BloodHound collection and AD CS checks during an engagement?

Chaining BloodHound collection and AD CS checks is handled by sequencing built-in tooling like Certipy. The orchestrator detects locally available tools and initializes a structured workflow covering discovery, collection, and vulnerability checks.

Do I need a specific local toolchain installed to automate AD pentest discovery?

Automating AD pentest discovery requires a local toolchain including NetExec, Impacket, BloodHound, Certipy, Responder, hashcat, Kerbrute, smbmap, and Snaffler. A detection script maps these available tools to compose the smallest viable engagement flow.

Can I substitute individual tools like NetExec or Impacket in an ADscan workflow?

Substituting underlying tools for ADscan-like operations is the core mechanism. The orchestrator maps whatever available toolchain is present locally and sequences those specific tools to execute discovery, credential validation, and SMB share analysis.

How do I maintain reproducibility when running on-premises Active Directory assessments?

On-premises AD assessments maintain reproducibility through structured evidence logging. The orchestrator records executed commands and outputs within a per-engagement workspace, ensuring the pentest workflow and derived lineage paths can be audited.

What limitations exist when orchestrating relay and cracking workflows with missing tools?

Orchestrating relay and cracking workflows depends on the presence of specific tools like Responder and hashcat. If the detection script cannot map a required tool, the orchestrator composes a workflow excluding that functionality rather than failing entirely.