adhammer-sdk 1.3.1

ADHammer Core — the AD audit + offensive toolkit as one importable SDK (re-exports the collector, graph, checks, kerberos, ldap, sysvol, bloodhound, secrets, and report subsystems). The CLI is the `adhammer` binary.
Documentation

ADHammer Core — the SDK

ADHammer is split into Core (this SDK — reusable libraries) and the CLI (the adhammer binary that drives them). This crate is the single import surface for Core: it re-exports every subsystem so a downstream tool can use adhammer_sdk::{graph, kerberos, …} instead of depending on each adhammer-* crate individually.

The subsystems, bottom-up:

  • [types] — core types (Sid, Guid, Snapshot, Finding). (the adhammer-core crate)
  • [collector] — LDAP collection into a Snapshot (TLS backend via crate features).
  • [checks] — the PingCastle-class audit rules.
  • [graph] — the control-path graph and executable attack chains ([graph::AttackPath]).
  • [kerberos] — AS-REP/Kerberoast, S4U/RBCD, PKINIT, ticket forging.
  • [ldap] — the raw LDAP client (NTLM/SASL) used for writes and relay.
  • [sysvol] — GPP cpassword + GptTmpl.inf analysis.
  • [bloodhound] — SharpHound-compatible BloodHound CE export.
  • [secrets] — offline SAM/LSA/DCC2 secret decryption.
  • [report] — JSON/HTML reporting.

For the DCE/RPC, NDR, PAC, DRSUAPI, GPO, and DPAPI layers, see the standalone crates dcerpc, ms-ndr, ms-pac, ms-drsr, gpo, and dpapi-offline.