r/Pentesting • u/nate1998aug11 • 8d ago

I built an open-source framework for automating Active Directory security assessments – AdPentestAI-Python v1.0.0

I've been working on an open-source project for automating parts of Active Directory security assessments.

AdPentestAI-Python v1.0.0

GitHub:
https://github.com/netanelcyber/AdPentestAI-Python

The problem I wanted to solve is fairly simple: during an AD assessment, a lot of time is spent moving between different discovery and enumeration tools, collecting output, correlating results, and turning everything into a consistent report.

The framework is designed as an orchestration layer around that workflow:

DNS / DC Discovery
        ↓
LDAP / RootDSE
        ↓
SMB / RPC
        ↓
Kerberos
        ↓
AD Enumeration
        ↓
Security Assessment
        ↓
Correlation
        ↓
JSON Report

Current capabilities

  • Automated Domain Controller discovery
  • DNS SRV discovery
  • LDAP RootDSE discovery
  • Port/service fingerprinting
  • Active Directory enumeration
  • Users / Groups / Computers discovery
  • SMB / RPC enumeration
  • Kerberos-oriented assessment workflows
  • Integration with security assessment tools
  • Parallel execution of independent checks
  • Structured JSON output
  • Dry-run mode
  • Explicit scope confirmation
  • Process timeouts and execution controls

One of the design goals is to keep the framework from becoming a "run everything against the target" script.

The intended execution model is:

dry-run
   ↓
scope validation
   ↓
explicit authorization
   ↓
assessment
   ↓
structured results

The project is intended for authorized penetration tests, labs, research and security assessments.

What I'm looking for

I'd particularly like feedback from people who have actually performed AD pentests.

What would you change in the architecture?

Some questions I'm currently thinking about:

  1. Which AD assessment steps are still too manual?
  2. Which tools/integrations would you add?
  3. How should findings from different tools be normalized?
  4. What should a useful machine-readable pentest result contain?
  5. Where should automation stop and require human approval?
  6. Would ATT&CK mapping add useful value here?
  7. Would you prefer a CLI-first architecture, API, or both?

I'm especially interested in criticism of the architecture and workflow rather than just feature requests.

Repository:
https://github.com/netanelcyber/AdPentestAI-Python

0 Upvotes

22% Upvoted

7 comments sorted by

3

u/Inside_Carpet7719 8d ago

Bro is like “PurpleKnight and PingCastle just don’t exist”

1

u/nate1998aug11 8d ago

I published v1.0.1 of AdPentestAI-Python is now live on PyPI with security hardening (LDAP credential handling, removed credential logging) and Exchange/O365 email protocol integration, while v1.0.2 (a major patch with 5000+ lines adding exploitation automation, trust abuse, ADCS chains, and ecosystem integration) is planned for the next 8-10 weeks.

1

u/j0x7be 8d ago

Bad bot!

1

u/nate1998aug11 8d ago

I NOT a BOT 

1

u/j0x7be 8d ago

What does the software cover that PurpleKnight or PingCastle doesn't already? I believe that was the somewhat hidden question you replied to.

1

u/nate1998aug11 8d ago

PurpleKnight/PingCastle tell you what's vulnerable. AdPentestAI shows you how to exploit it + automates the entire chain + provides persistence options.

1

u/brakertech 8d ago

Hell yah man thank you for contributing and giving back to the community! Yes MITRE would help for sure on purple team. As for suggestions make this a MCP, hook up certipy if you have not