AutoAttack vs Nessus on GOAD

TL;DR: Two tools, one task: start on a network with no credentials and see how far each gets. Same GOAD lab, same network position, same afternoon. Nessus spent 24 minutes and inventoried 116 high and medium exposures. AutoAttack took 45 seconds to reach Domain Admin in all three domains. The tools are built for different jobs, and the distance between their results is what the test measures.

Nessus is an exposure scanner. Its job is breadth: enumerate the hosts, services, and known weaknesses on a network, then rank them so a defender knows what to fix first. AutoAttack is an autonomous adversary. Its job is depth: starting from no credentials, find a path to a stated objective and walk it. One produces an inventory of what is exposed; the other produces a worked path to a goal. We gave both the same starting position and recorded four things: how long each took, what it produced, whether it reached Domain Admin, and when.

The setup

Both tools ran against GOAD, "Game of Active Directory" (Orange Cyberdefense), restored to the same vanilla snapshot: two forests, three domains, five Windows hosts, the usual cross-domain trusts. Both connected from the same address on the same subnet, with line of sight to all five hosts. Neither started with a username or password.

Nessus ran as Nessus Professional in its most thorough unauthenticated configuration: the Advanced template, thorough tests, paranoid plugin accuracy, all 65,535 TCP ports, every plugin family, safe checks left on. This is Nessus doing as much as it can without credentials.

The attack chain

This is the path AutoAttack took from that same starting position. The chain runs entirely over network protocols: Kerberos, LDAP, SMB, remote registry, DRSUAPI. It writes nothing to any target's disk.

No authentication required. Two accounts have Kerberos pre-authentication disabled, so the domain controller will issue a crackable ticket to anyone who asks for one: brandon.stark in NORTH and missandei in ESSOS. AutoAttack requests both, captures the AS-REP hashes, and cracks them offline against AES in seconds.

ESSOS Domain Admin, 0:41. missandei's cracked password is admin on the ESSOS domain controller. A DCSync there pulls the ESSOS krbtgt key and the trust key shared with the SEVENKINGDOMS forest.

SEVENKINGDOMS Domain Admin, 0:42. With the krbtgt and the trust key, AutoAttack forges a Golden Ticket carrying an ExtraSID for the parent forest and crosses the trust. A DCSync against the SEVENKINGDOMS DC returns its Administrator.

NORTH Domain Admin, 0:45. The forest-root account replicates the child domain. A DCSync against the NORTH DC returns every credential it holds.

By the time it stopped at 2m 37s, the run had recovered 124 credentials and logged 85 findings across 327 actions on 5 hosts. Each finding is an action it carried out, with the captured output behind it.

Results

The three domains fell within four seconds of each other.

Domain	Domain Admin at	Method
ESSOS	0:41	AS-REP roast, offline crack, admin on the DC
SEVENKINGDOMS	0:42	Golden Ticket with ExtraSID across the forest trust
NORTH	0:45	DCSync from the forest-root account

Over the same window, Nessus returned a severity breakdown:

Severity	Count
Critical	0
High	22
Medium	94
Low	5
Informational	692

What Nessus found

Breadth is where a scanner earns its place, and across a real network that coverage is worth having. Nessus's 22 high-severity items came down to three issues: 64-bit block ciphers (SWEET32) on 20 services, one SMBv1 flag, and one MS17-010 (EternalBlue) flag. The 94 mediums are almost all transport hygiene: deprecated TLS 1.0 and 1.1, untrusted and self-signed certificates, RC4, SMB signing not enforced. They are spread fairly evenly across the hosts: kingslanding 4 high / 15 medium, winterfell 4 / 15, meereen 6 / 19, castelblack 4 / 21, braavos 4 / 24. Weak ciphers and unsigned SMB are worth fixing wherever they turn up.

Two qualifications. The EternalBlue flag came from an unauthenticated check, which infers exposure from version and behavior rather than confirming it; Nessus did not exploit it, and neither did we, so it is a lead rather than a result. And none of the 116 high or medium items is a confirmed compromise: each is an exposure worth checking, which is exactly what a scanner is built to report.

Indicators and execution

The path that took the three domains (the two AS-REP tickets, the forged cross-trust ticket, the chain of DCSyncs) does not appear anywhere on the Nessus report. None of those steps is a vulnerability in the CVE sense. Each is a configuration choice that is harmless on its own and only bites once it is joined to the next one. A scanner finds and ranks exposures one at a time and does not combine them; combining them into a working path is what AutoAttack did, and what an intruder does.

That difference is what the two columns measure. Nessus's most severe label is "high," applied 22 times to exposures that were never exploited. AutoAttack returned three results at a single severity, full domain compromise, each with the captured proof behind it. Neither count is wrong.

With credentials

The unauthenticated run is the fair test, since an intruder is rarely handed an account on day one. It is still worth seeing what Nessus does when it isn't working blind, so we ran it again with valid Domain Admin credentials for all three domains (access AutoAttack never had).

The counts climb sharply:

Severity	Black-box	With Domain Admin
Critical	0	158
High	22	353
Medium	94	127
Low	5	7
Informational	692	1,506

511 critical and high, up from 22, in 28m 48s. This is what a credentialed scan is for, and on a maintained network the result is valuable. Close to all 511 are missing patches and known CVEs: old Server 2016, .NET, SQL Server, SQLite. GOAD runs deliberately old, unpatched Windows, so a credentialed pass lights up, as it should.

What the list does not contain is how the domains actually fell. None of the 511 is a pre-authentication-disabled account, a crackable Kerberos ticket, a reused service password, or a cross-forest trust key. Those are not missing patches; they are how Active Directory is configured, and a patch-and-CVE inventory does not record them. Handed the keys outright, Nessus produced a longer and more detailed list that has little overlap with the chain that compromised the forest.

What this shows, and what it doesn't

GOAD is a deliberately vulnerable lab, not a customer network. These are not customer numbers, and a hardened environment would slow both tools down. What the comparison isolates is the difference between the two tools on identical ground: the same snapshot, the same network position, the same absence of credentials, the same afternoon.

A scanner reports where your weak ciphers and unsigned protocols live, which is real and useful work. What it does not report is that a neglected account will hand out a ticket that, two forests and a few seconds later, reads your entire directory. Catching that takes a tool that walks the path rather than one that lists its parts. For the at-a-glance version, see AutoAttack vs Nessus; for the broader practice behind the chain, see Active Directory penetration testing; or read the full benchmark.

Run a free campaign against your network.

---

Both tools ran against the same GOAD vanilla snapshot (Orange Cyberdefense) from the same network position with no credentials, on 2026-06-24. Nessus Professional: Advanced template, all TCP ports, every plugin family, thorough and paranoid settings, safe checks on; the credentialed run added valid Domain Admin accounts for all three domains. AutoAttack: standalone, zero credentials. Every AutoAttack time above is taken from the run log.