How seraphimdeck/serad works
serAD is a read-only Active Directory and AD CS audit CLI. An operator supplies target and credentials; the CLI validates the target, connects to LDAP, harvests domain and PKI data, runs AD risk detection plus an HTTP ESC8 probe, then prints and exports findings. The graph preserves the distinct safety, collection, detection, and reporting stages. The README documents broader detection coverage; sampled source confirms the engine’s dispatch and ESC8 probe, but not each detector or harvester’s internals.
Main entry points: main.go Audit CLI · engine.go Detection Engine · esc8_checker.go ESC8 Probe · gatekeeper.go Safety Checks
Components 21
Target Safety
- Safety Checks
pkg/gatekeeper/gatekeeper.go - TTL Check
pkg/gatekeeper/ttl.go
Data Collection
- LDAP Client
pkg/ldap/client.go - Domain Harvest
pkg/ldap/domain_harvester.go - PKI Harvest
pkg/ldap/pki_harvester.go - AD Objects
pkg/models/ad_objects.go
Risk Analysis
- Detection Engine
pkg/detectors/engine.go - Certificate Risks
pkg/detectors/esc1_3.go - AD Risks
pkg/detectors/kerberoast.go - Delegation Risks
pkg/detectors/delegation.go - HTTP Probe Client
pkg/http/client.go - ESC8 Probe
pkg/http/esc8_checker.go - Audit Findings
pkg/models/finding.go
Audit Output
- Audit Metadata
pkg/models/metadata.go - Terminal Report
pkg/reporter/terminal.go - Markdown Export
pkg/reporter/markdown.go - JSON Export
pkg/reporter/json.go
Other components
- Auditor
- Audit CLI
cmd/serAD/main.go - AD Domain Controller
- Report Files
Connections 25
- Auditor → Audit CLI: provides options
- Audit CLI → Safety Checks: validates target
- Safety Checks → TTL Check: checks hop limit
- Audit CLI → LDAP Client: opens LDAP
- LDAP Client → AD Domain Controller: binds and searches
- Audit CLI → Domain Harvest: harvests domain
- Audit CLI → PKI Harvest: harvests PKI
- Domain Harvest → AD Objects: produces records
- PKI Harvest → AD Objects: produces records
- Audit CLI → Detection Engine: runs detection
- Detection Engine → Certificate Risks: dispatches checks
- Detection Engine → AD Risks: dispatches checks
- Detection Engine → Delegation Risks: dispatches checks
- Detection Engine → Audit Findings: returns findings
- Audit CLI → HTTP Probe Client: creates probe client
- Audit CLI → ESC8 Probe: checks each CA
- ESC8 Probe → HTTP Probe Client: sends HTTP request
- ESC8 Probe → AD Domain Controller: probes enrollment
- ESC8 Probe → Audit Findings: returns finding
- Audit CLI → Terminal Report: prints findings
- Audit CLI → Markdown Export: exports findings
- Audit CLI → JSON Export: exports findings
- Audit CLI → Audit Metadata: supplies metadata
- Markdown Export → Report Files: writes report
- JSON Export → Report Files: writes report