Active Directory relationship visualization and attack path discovery tool.
| Component | Description |
|---|
| BloodHound | GUI for visualizing and querying AD relationships |
| SharpHound | C# data collector (runs on Windows domain-joined hosts) |
| bloodhound-python | Python-based remote collector (runs from Linux) |
| Neo4j | Graph database backend |
sudo apt install bloodhound neo4j
sudo neo4j console
Default Neo4j credentials: neo4j:neo4j (change on first login at http://localhost:7474)
pip install bloodhound
.\SharpHound.exe -c All --zipfilename output
.\SharpHound.exe -c DCOnly
.\SharpHound.exe -c Session,LoggedOn
.\SharpHound.exe -c Group,Trusts,ACL
.\SharpHound.exe -c All -d domain.local --ldapusername user --ldappassword pass
.\SharpHound.exe -c Session --Loop --LoopDuration 02:00:00 --LoopInterval 00:05:00
| Method | Description |
|---|
Default | Group membership, domain trusts, local admin, sessions |
All | All collection methods |
DCOnly | Collectable from DC only (no host enumeration) |
Session | Session data |
LoggedOn | Privileged session collection |
Group | Group membership |
Trusts | Domain trust data |
ACL | ACL data |
ObjectProps | Object properties |
Container | OU/GPO container structure |
RDP | Remote Desktop access |
DCOM | DCOM access |
PSRemote | PowerShell Remoting access |
SPNTargets | SPN targets |
| Flag | Description |
|---|
--zipfilename NAME | Custom output zip file name |
-s / --searchforest | Search all domains in the forest |
--stealth | Stealth collection (prefer DCOnly) |
-f FILTER | Add LDAP filter to pregenerated filter |
--computerfile FILE | File with specific computer targets |
bloodhound-python -u user -p 'Password123' -d domain.local -ns 172.16.5.5 -c All
bloodhound-python -u user -p 'Password123' -d domain.local -dc dc01.domain.local -ns 172.16.5.5 -c All
sudo neo4j start
bloodhound
- Click the “Upload Data” button (up arrow icon)
- Select the
.json or .zip files from SharpHound/bloodhound-python
| Query | Description |
|---|
| Find all Domain Admins | Maps DA group members |
| Find Shortest Paths to Domain Admins | Attack paths to DA |
| Find Principals with DCSync Rights | Users that can perform DCSync |
| Find Computers with Unsupported OS | Legacy systems |
| Find Kerberoastable Accounts | SPNs set on user accounts |
| Find AS-REP Roastable Users | Pre-auth disabled accounts |
| Shortest Paths to High Value Targets | Quickest escalation paths |
| Find Computers Where Domain Users are Local Admin | Over-permissioned hosts |
MATCH (u:User) WHERE u.hasspn=true RETURN u.name, u.serviceprincipalnames
MATCH (u:User) WHERE u.admincount=true RETURN u.name
MATCH p=shortestPath((u:User {owned:true})-[*1..]->(g:Group {name:"DOMAIN ADMINS@DOMAIN.LOCAL"})) RETURN p
MATCH p=(c:Computer)-[:HasSession]->(u:User) RETURN p
- Mark compromised users/computers as “Owned” to find paths from your current position
- Mark high-value targets to focus path discovery
- Use “Shortest Paths from Owned Principals” after marking owned nodes
- Session data is time-sensitive — re-collect periodically with
--Loop
DCOnly collection is stealthier (no host enumeration)- Export graphs and paths for inclusion in reports