ADScanPro / adscan

Free Active Directory pentesting tool for Linux, macOS and Windows. Automates AD and LDAP enumeration, Kerberoasting, ASREPRoast, password spraying, ADCS/ESC1, DCSync, RBCD, gMSA, shadow credentials, NTLM relay and credential dumping across 104 techniques, mapping BloodHound-compatible attack paths to Domain Admin. NIS2 / ISO 27001 reports.

Noz2 / RootHound

Map your path from a low-priv user to roo, like BloodHound, for local Linux privesc.

An0nUD4Y / bloodhound-ldapx.py

Modified BloodHound.py CE ingestor for red team use. Obfuscates LDAP through ldapx, paces LDAP searches and host RPC, and resumes a stopped collection. Writes BloodHound CE JSON.

warpedatom / NoiseHound

Detection-aware BloodHound attack-path scoring - the quietest route to your objective, calibrated across five detection tiers (audit/EDR/Elastic/MDI/WDAC) plus Azure.

crypt0p3g / adexview

Browse, search and audit AD Explorer snapshots offline in your browser: decoded attributes, LDAP filters, and reports for what BloodHound doesn't show (DNS, subnets, DFS, GPO links, LAPS, AD CS).