Speeding Up AD Pentests with ADScan & ADPulse

What it is

A Hackers-Arise walkthrough of two Active Directory tools: ADScan (Docker/pipx-based active enumeration + exploitation, BloodHound-integrated) and ADPulse (read-only LDAP/LDAPS auditing that emits CLI/JSON/HTML reports). The summary covers the comparison; below is what the page actually gives you to act on.

What to do

ADScan setup requires Docker on Kali first, then pipx:

kali > sudo apt install docker.io
kali > sudo apt install docker-compose
kali > sudo service docker start
kali > sudo systemctl enable docker
kali > pipx install adscan
kali > adscan install
kali > adscan start

adscan install needs a stable connection and prints BloodHound credentials on completion. Inside the interface, start_auth prompts for domain creds/details and triggers the automated pass (BloodHound ingest, Kerberoast/AS-REP discovery, ADCS path-finding). It works credential-less or with a low-priv account.

ADPulse runs against a DC over LDAP/LDAPS:

kali > python -m venv venv
kali > source venv/bin/activate
kali > pip install -r requirements.txt
kali > python ADPulse.py --domain sekvoya.local --user lowpriv --password 'P@ssw0rd123!'

How it works

After enumeration ADScan offers two separate attack-path engines: the BloodHound engine chains findings into paths (spraying, Kerberos attacks, NTLM capture), while a local Python DACL-search engine finds permission abuse independently — in the example it flagged that the low-priv user could directly modify Domain Admins membership. The page attributes the GenericAll finding to SDProp manipulation, i.e. permissions set in ways RSAT does not surface. ADScan also checks DCs for known vulns, naming Zerologon and NoPac on older systems — details the summary omits.

Caveats

• The ADPulse clone command in the post uses a placeholder URL (https://github.com/yourorg/adpulse.git), so it will not clone as written — you must locate the real repository yourself. ADScan's pipx install adscan is the only package reference that looks concrete.
• The note in the ADPulse command block uses en-dashes (–domain) rather than double hyphens; retype flags as --domain etc.
• The post itself stresses these tools "do not replace understanding" — output still needs validation, and it frames success as communicating risk, not necessarily reaching Domain Admin.

The only real branch here is ADScan's dual engines, worth noting since the DACL engine finds paths BloodHound's may not:

flowchart TD
    A[start_auth: creds + BloodHound ingest] --> B{Attack-path engine}
    B -->|BloodHound| C[Chained paths: spray, Kerberos, NTLM capture]
    B -->|Local Python DACL search| D[Direct DACL abuse e.g. modify Domain Admins]
    A --> E[DC vuln check: Zerologon / NoPac]