Crate adhammer_sdk 

ADHammer Core — the SDK

ADHammer is split into Core (this SDK — reusable libraries) and the CLI (the adhammer binary that drives them). This crate is the single import surface for Core: it re-exports every subsystem so a downstream tool can use adhammer_sdk::{graph, kerberos, …} instead of depending on each adhammer-* crate individually.

The subsystems, bottom-up:

• types — core types (Sid, Guid, Snapshot, Finding). (the adhammer-core crate)
• collector — LDAP collection into a Snapshot (TLS backend via crate features).
• checks — the AD hygiene audit rules (privileged accounts, trusts, stale objects, anomalies).
• graph — the control-path graph and executable attack chains (graph::AttackPath).
• kerberos — AS-REP/Kerberoast, S4U/RBCD, PKINIT, ticket forging.
• ldap — the raw LDAP client (NTLM/SASL) used for writes and relay.
• sysvol — GPP cpassword + GptTmpl.inf analysis.
• bloodhound — BloodHound CE v5 ingest export.
• secrets — offline SAM/LSA/DCC2 secret decryption.
• report — JSON/HTML reporting.

For the DCE/RPC, NDR, PAC, DRSUAPI, GPO, and DPAPI layers, see the standalone crates dcerpc, ms-ndr, ms-pac, ms-drsr, gpo, and dpapi-offline.

Re-exports

pub use blackbox::BlackBoxRunner;

pub use blackbox::CheckSelection;

pub use blackbox::ConsentPolicy;

pub use blackbox::RunPolicy;

pub use blackbox::RunSummary;

pub use blackbox::RunnerRefusal;

pub use adhammer_core as types;

pub use adhammer_bloodhound as bloodhound;

pub use adhammer_checks as checks;

pub use adhammer_collector as collector;

pub use adhammer_graph as graph;

pub use adhammer_kerberos as kerberos;

pub use adhammer_ldap as ldap;

pub use adhammer_report as report;

pub use adhammer_secrets as secrets;

pub use adhammer_sysvol as sysvol;

Modules

blackbox

Black-box runner control-plane.