GO KALI FREE

BloodHound

Post Exploitation

Advancedlow risk

BloodHound uses graph theory to reveal the hidden and often unintended relationships within an Active Directory or Azure environment, allowing attackers or defenders to identify complex attack paths.

Installation

sudo apt install bloodhound

Basic Syntax

bloodhound [options]

Quick Facts

Full Name
BloodHound
License
Apache 2.0
Language
C# / JavaScript
Interface
Graphical UI (Electron)
Category
AD Enumeration
Requires
Neo4j Database

Tool Overview

BloodHound uses graph theory to reveal hidden and unintended relationships in Active Directory environments. It maps objects as nodes and permissions as edges, enabling security professionals to identify complex attack paths.

By collecting data from domain controllers and workstations, BloodHound visualizes the shortest path to Domain Admin, highlighting ACL abuses, group nesting issues, and privilege escalation opportunities.

Common Commands

bloodhoundLaunch the BloodHound graphical user interface
sudo neo4j consoleStart the Neo4j database in the foreground
sudo neo4j startStart the Neo4j database as a background service
sudo neo4j stopStop the running Neo4j database service
SharpHound.exe -c AllCollect all AD data from a domain-joined Windows host
SharpHound.exe -c DCOnlyCollect data by querying only the domain controller (stealthier)
SharpHound.exe -c ACL,Group,SessionRun a targeted collection of specific data categories
SharpHound.exe -d corp.localSpecify the target domain to enumerate
SharpHound.exe --zipfilename lootSet a custom name for the output ZIP archive
SharpHound.exe --Loop --Loopduration 02:00:00Continuously collect session data over a time window
bloodhound-python -d corp.local -u user -p pass -c AllCollect AD data remotely from Linux with the Python ingestor
bloodhound-python -d corp.local -u user -p pass -ns 10.0.0.1 -c AllCollect via a specified name server (domain controller IP)
AzureHound.exe -u user@tenant -p pass listCollect Azure AD / Entra ID data with AzureHound
azurehound -u user@tenant -p pass list -o output.jsonRun AzureHound on Linux and write results to JSON
python3 -m http.serverServe loot files to move the ZIP to your analysis host

Step-by-Step Guide

  1. 1Execute the collection executable on a machine connected to the domain
  2. 2Extract the resulting archive file to your analysis machine
  3. 3Ensure your backend database service is operational
  4. 4Open the application and authenticate to the database
  5. 5Drag and drop the collected archive into the program
  6. 6Utilize the built-in queries to visualize routes to elevated privileges

Warnings

Use Cases

Attack Path Mapping

Visualize AD privilege escalation paths.

ACL Abuse Analysis

Find overly permissive ACLs and delegations.

Kerberos Attack Detection

Identify AS-REP roastable and Kerberoastable users.

Azure AD Analysis

Map Azure AD relationships and privileges.

Key Features

Related Tools

CrackMapExec

Post Exploitation

AD lateral movement toolkit.

Impacket

Post Exploitation

Protocol attacks for Windows networks.

Mimikatz

Post Exploitation

Credential extraction tool.

Frequently Asked Questions

What is BloodHound used for?

BloodHound maps relationships and attack paths within Active Directory and Azure environments. It uses graph theory to identify complex privilege escalation paths from an initial foothold to Domain Admin.

How does BloodHound collect data?

BloodHound uses collectors (SharpHound for Windows, AzureHound for Azure) to gather AD objects, permissions, sessions, and ACLs. The data is exported as JSON files and imported into the BloodHound UI.

What is a typical attack path in BloodHound?

A typical attack path might show: User A is member of Group B which has WriteDACL on Group C with GenericAll on User D who is admin on Server E. BloodHound visualizes each step toward a target like Domain Admins.

Is BloodHound only for attackers?

No, BloodHound is equally valuable for defenders. Blue teams use BloodHound to identify and remediate overly permissive ACLs, dangerous group memberships, and unintended privilege escalation paths in their AD environment.

Tags

#post-exploitation#active-directory#graph-theory#reconnaissance

Output Explanation

The tool generates an interactive visual graph. Dots represent network objects, and connecting lines show the rights they have over each other. Highlighted paths map out exact steps to escalate privileges.

Ethical Usage Notice

This tool is designed for authorized security testing, educational purposes, and legitimate network administration only. Unauthorized access to computer systems is illegal.