AutoAttack vs Nessus on GOAD

On 24 June 2026, we ran Nessus Professional and AutoAttack against the same vanilla GOAD snapshot: two forests, three domains and five Windows hosts. Neither test received credentials. AutoAttack reached Domain Admin in all three domains by 0:45. Nessus completed its vulnerability scan in 24m 04s and reported 22 high-severity and 94 medium-severity items.

Nessus inventories vulnerabilities. We gave AutoAttack's autonomous red team agent the goal of gaining Domain Admin across the lab's three domains. It used recovered credentials and domain trusts to pursue that goal. We compared their evidence from the same starting position. A scan finding and a demonstrated compromise are different results.

The setup

We restored Game of Active Directory (GOAD) to the same vanilla snapshot for each test. Both ran from the same address and subnet, with access to all five hosts and no supplied credentials: one unauthenticated test per product.

Nessus Professional used the Advanced template with thorough tests, paranoid plugin accuracy, all 65,535 TCP ports and every plugin family enabled. Safe checks remained on. This tested one configuration; Tenable documents the available discovery settings.

The attack chain

The agent used Kerberos, LDAP, SMB and directory replication to advance toward its Domain Admin goal.

First credentials. Two accounts had Kerberos pre-authentication disabled: brandon.stark in NORTH and missandei in ESSOS. AutoAttack captured their AS-REP responses and recovered the passwords offline.

ESSOS Domain Admin, 0:41. The recovered missandei credential had administrative access on the ESSOS domain controller. Directory replication returned the ESSOS krbtgt key and the trust key shared with the SEVENKINGDOMS forest.

SEVENKINGDOMS Domain Admin, 0:42. AutoAttack forged a Kerberos ticket with additional security identifiers and crossed the trust. Replication against the SEVENKINGDOMS domain controller returned its Administrator account.

NORTH Domain Admin, 0:45. The forest-root access enabled replication of the child domain through the NORTH controller.

The AutoAttack run ended at 2m 37s. Its log lists 124 recovered credentials, 85 findings and 327 actions across five hosts.

Results

One AutoAttack campaign on vanilla GOAD, with no supplied credentials: two forests, three domains and five Windows hosts, tested on 24 June 2026.

Nessus's unauthenticated report from the same snapshot:

What the Nessus report showed

The 22 high-severity items covered 64-bit block ciphers (SWEET32) on 20 services, one SMBv1 flag and one MS17-010 flag. Most medium-severity items concerned transport settings: old TLS versions, untrusted or self-signed certificates, RC4 and SMB signing not enforced.

The MS17-010 item came from an unauthenticated check. Neither test exploited it, so it remains a reported exposure requiring validation.

This Nessus report, produced with the Advanced template and settings above, did not contain AutoAttack's credential-and-trust route.

A second Nessus run with credentials

We also ran Nessus with valid Domain Admin credentials for all three domains. These results have a different starting condition from AutoAttack's uncredentialed campaign.

The credentialed scan of this deliberately vulnerable GOAD lab finished in 28m 48s with 511 critical or high-severity items, mostly missing patches and known vulnerabilities in Windows Server, .NET, SQL Server and SQLite.

The credentialed report expanded the software inventory but did not describe AutoAttack's route through Kerberos configuration and trusts.

What to take from the result

Nessus returned a vulnerability inventory; AutoAttack established domain control through its credential-and-trust route. Use the test settings and evidence in this comparison to decide which assessment fits your objective.

Read AutoAttack vs Nessus for the comparison table, Active Directory penetration testing for the underlying assessment questions, or the full benchmark for both published experiments.