ADscan 10.1.0

Added

• SQL Server attack coverage: linked-server lateral movement across domain and forest trusts, automated command execution through the database with escalation to SYSTEM, and arbitrary file read via bulk import. Each is surfaced as a first-class, validated attack step in the report.
• Shadow Credentials escalation: ADscan now detects when it can write a key credential to a target account and authenticate as it, and executes the full chain end to end.
• Extended-rights escalation is modeled per target and chained into attack paths: forced password reset, directory replication (DCSync), and LAPS password read.
• Control over a Group Policy Object is now chained through to code execution via a scheduled task on the machines the GPO applies to.
• Credential capture through a pivot: NTLM authentication can be captured across a routed tunnel, with per-target selection of the callback address.
• Writable-share credential bait (opt-in): ADscan plants a bait file on shares the current user can write to and captures the resulting authentication attempts as a background job that does not block the scan.
• Certificate Services attacks now run through a native implementation, including detection of delegated CA-management rights and detection of Extended Protection on the web-enrollment endpoint (which suppresses false ESC8 findings when enrollment is hardened).
• adscan execute attack_paths runs a single attack path or step against a saved workspace without a full scan. When the starting account is already owned, its credential is resolved from the workspace, so no username or password needs to be re-supplied. A companion re-arm resets step status so a path can be run again.
• REPL commands now accept flag-form arguments (-d/--dc-ip/-u/-p/--host/--service) alongside the existing positional form, with tab-completion for both flag names and values.
• Recovery of secrets protected with PowerShell ConvertFrom-SecureString -Key, chained into share-password findings.
• Web ports 8080 and 8443 are now included in the important-ports sweep and folded into service discovery.

Changed

• Attack paths are ordered proof-first in the report and the web dashboard, leading with the validated low-privilege-to-domain-compromise path rather than theoretical ones.
• Attack-step headers in the report and web now read as plain-language business headlines, with the underlying technical name kept as a subtitle.
• More honest result states for attack paths: "Partially Validated" for a chain proven in part but not end to end, "Not Executed for Safety" for destructive steps ADscan deliberately refuses to run, and "Attack Surface Reduced — Hardening Observed" for avenues your own configuration closes.
• Remediation guidance is now written entirely in native Microsoft tooling (RSAT Active Directory module, dsacls, Get-*/Set-*), goes deeper on the exact object, command, and expected before/after, and no third-party or competitor product names appear anywhere in client-facing report text.
• The AD exposure score now combines proof strength with per-technique exploitability.
• The SQL Server post-authentication workflow runs automatically in unattended scans instead of defaulting to skip.
• New scan-configuration toggles for network pivoting and writable-share bait, available in both the CLI and the web console.
• Running the ADscan core directly on the host machine is now refused with a clear explanation; the tool runs only inside its container.

Fixed

• An unauthenticated scan could fail to record its domain and silently drop findings.
• Password-spray coverage now distinguishes "lockout threshold unknown" from "lockout confirmed disabled" instead of conflating the two.
• A domain controller reachable but with its DNS service down is no longer reported as "Validation Failed".
• Scan timeline durations are no longer corrupted by mid-scan clock synchronization, which previously produced implausible multi-day phase times.
• Password cracking no longer takes over the terminal or prints recovered-hash previews into logs.
• Network preflight now correctly recognizes a hardened domain controller that exposes only Kerberos and LDAPS.
• Kerberos user enumeration streams its wordlist live with a dynamic early stop and no longer re-offers an auto-detect attempt that already failed.
• Directory changes ADscan makes (such as a planted key credential) are always disclosed in the report, and cleanup is reported accurately — including flagging the cases that require manual removal — even when a later step in the chain fails.
• Planted key credentials are removed by their exact stored value rather than a reformatted version, and the environment-change ledger is always initialized so every change ADscan made is attested.
• Group Policy password (GPP) findings are no longer misclassified, and false-positive findings are gated on confirmation before they reach the report.

Removed

• Nine REPL commands were renamed to native names; the previous names are no longer accepted.
• The "Blocked by Active Controls" report category was removed. ADscan reports whether an attack path exists and never claims that a defensive product it cannot observe stopped an attack.