v1.0.1 Released: Security Patches + Exchange/O365 Integration + Advanced Nmap

[netanelcyber]

🎉 AdPentestAI-Python v1.0.1 Now Available

We're excited to announce v1.0.1—a security-focused release with major enhancements for Exchange/O365 environments and advanced Active Directory reconnaissance capabilities.

🔒 Security Improvements

SEC-001: Refactored LDAP Credential Handling

• Issue: Hardcoded empty credentials pattern in LDAP connections
• Fix: Replaced with proper anonymous connection pattern
• Impact: Clearer code, better security posture

SEC-002: Removed Credential Logging

• Issue: Sensitive usernames exposed in stderr logs
• Fix: Removed all credential-revealing logging statements
• Impact: Compliance with OWASP credential handling best practices
• Reference: See SECURITY.md for policy details

📧 NEW: Exchange/O365 Email Protocol Integration

Game-changer for email assessment workflows:

nmap detects Exchange ports (25, 110, 143, 465, 587, 993, 995)
    ↓
Auto-identifies Exchange 2016/2019/2021 OR O365 cloud
    ↓
Automatically triggers email enumeration pipeline:
   • SMTP user discovery (VRFY + RCPT TO commands)
   • POP3/IMAP credential testing
   • Protocol fallback chain (SMTP → POP3 → IMAP)
    ↓
Complete email reconnaissance in one integrated workflow

What This Means:

• No more manual tool switching between network scan and email enum
• Unified JSON output for Exchange + AD findings
• Protocol fallback handles firewall restrictions automatically
• Identifies on-premises vs cloud email deployments

🔧 Advanced Nmap Functions (NEW)

Enhanced network reconnaissance for AD environments:

1. Service Version Detection

• Exchange, Kerberos, LDAP version identification
• Focuses on critical ports: 88, 389, 445, 25, 110, 143

2. OS Fingerprinting

• Domain controller operating system detection
• Informs exploitation strategy selection

3. Vulnerability Scanning

• EternalBlue (MS17-010) detection
• Zerologon (CVE-2020-1472) detection
• LDAP service vulnerabilities

4. NSE Script Integration

• smb-enum-users.nse — SAM user enumeration
• smb-enum-shares.nse — Share discovery
• ldap-search.nse — LDAP reconnaissance
• krb5-enum-users.nse — Kerberos user enumeration
• Exchange-specific scripts for OWA/EWS detection

5. UDP Service Discovery

• DNS, DHCP, SNMP, Kerberos enumeration
• Improves network visibility

6. Firewall/ACL Detection

• ACK scanning for defensive posture analysis
• Filtered vs closed port differentiation

📊 Performance & Coverage

v1.0.1 Improvements:

• 10-15x faster parallel execution (existing)
• NEW: 5-10x more comprehensive email findings via Exchange integration
• NEW: 3-5x deeper network reconnaissance via advanced nmap
• Unified output: AD + Email + Network findings in single JSON

🚀 Example Workflow (v1.0.1)

# Dry-run to preview all tools and strategies
python -m adpentest --target corp.local --mode dry-run --scope-confirmed

# Active scan with v1.0.1 enhancements
python -m adpentest --target corp.local --mode active --scope-confirmed

Output now includes:

{
  "dc_detection": {...},
  "exchange_servers": [
    {
      "host": "mail.corp.local",
      "version": "Exchange 2019",
      "email_users_discovered": 42,
      "valid_credentials_found": 3
    }
  ],
  "nmap_results": {
    "services": [...],
    "vulnerabilities": [...],
    "firewall_rules": [...]
  },
  "email_enum": {
    "users_discovered": [...],
    "protocols_tested": ["SMTP", "POP3", "IMAP"],
    "successful_auths": 3
  }
}

📦 Installation

pip install --upgrade adpentest==1.0.1

PyPI: https://pypi.org/project/adpentest/

🐛 Breaking Changes

None. Full backward compatibility with v1.0.0 scripts and configurations.

🎯 Use Cases

Red Teamers:

• Faster email compromise via integrated Exchange detection
• Reduced reconnaissance time = more focus on post-exploitation

Penetration Testers:

• Comprehensive Exchange assessment reports
• Demonstrates thorough email security evaluation

Security Researchers:

• Understand modern AD + email attack surface
• Contribute improvements via GitHub

💬 Community Discussion

What would you like to see next?

• Automatic credential wordlist generation
• HTML/PDF report generation
• ADCS certificate template enumeration enhancements
• DNS zone transfer attempts
• Kerberos pre-auth brute force optimization
• SMB share content scanning

Drop your feature requests and feedback below!

📚 Resources

• GitHub: https://github.com/netanelcyber/AdPentestAI-Python
• Documentation: See CLAUDE.md for architecture deep-dive
• Security Policy: See SECURITY.md for authorization guidelines
• Contributing: See CONTRIBUTING.md for contribution workflow

---

Questions? Feedback? Join the discussion below! 👇