BloodHound

What is it?

BloodHound is a tool that answers the question: "How do I get from where I am to Domain Admin?"

Active Directory is a web of relationships, user A is member of group B, group B has GenericWrite on user C, user C has a session on server D, and server D is a Domain Controller. Manually tracing these relationships across hundreds or thousands of objects is impossible. BloodHound automates it.

It has two parts:

1. SharpHound (the collector): runs on the target Windows machine or remotely. Queries AD via LDAP, collects users, groups, computers, sessions, ACLs, trusts, and GPOs. Outputs a zip file with JSON data.
2. BloodHound (the GUI): runs on your attacker machine. Imports the SharpHound data into a Neo4j graph database and visualizes it. You click "Find shortest path to Domain Admin" and it draws the attack chain.

Think of it as Google Maps for Active Directory: SharpHound surveys the roads, BloodHound plots the route.

Run this first

Start the database, collect data from the domain, then open BloodHound to import it.

$ sudo neo4j start
# wait about 15 seconds, then
$ bloodhound &

$ bloodhound-python -u jsmith -p Password123 -d corp.local -c All -ns 10.10.10.10

• sudo neo4j start starts the database BloodHound reads from. BloodHound won't connect without it.
• -c All collects everything, including ACLs. Using Default instead misses the ACL data where many attack paths live.

Drag the output JSON files into the BloodHound window. Mark your current user as Owned, then run the built-in "Shortest path to Domain Admins" query to see the first path.

What does it do?

After importing data, BloodHound can answer questions like:

• What is the shortest path from my compromised user to Domain Admin?
• Which users have DCSync rights?
• Which computers have unconstrained delegation?
• Where do Domain Admins have active sessions? (session hijacking targets)
• Which users can reset another user's password?
• Which users/groups have GenericAll/GenericWrite/WriteDACL on sensitive objects?
• What are the Kerberoastable accounts with a path to high-value targets?
• Which GPOs can be abused to push malicious scripts?

These are all built-in queries: you click them in the UI. You can also write custom Cypher queries for anything specific.

When do you use it?

Immediately after getting domain credentials. Run BloodHound on every AD engagement. Without it you are guessing which accounts and groups lead to Domain Admin.

The typical workflow:

1. Get initial access (phishing, web exploit, password spray, whatever)
2. Get domain credentials (any domain user works)
3. Run SharpHound: collect the AD data
4. Import into BloodHound: analyze attack paths
5. Follow the path BloodHound shows you

How do you spot it?

You don't "spot" when to use BloodHound, you always use it in AD. The real question is what to look for in the output.

How do you use it?

Part 1: Setting up BloodHound (one-time on Kali)

# Start Neo4j (the graph database BloodHound uses)
$ sudo neo4j start
# First time: browse to http://localhost:7474, login neo4j/neo4j, set new password

# Start BloodHound
$ bloodhound
# Login with your Neo4j credentials (bolt://localhost:7687)

Part 2: Collecting data with SharpHound

SharpHound runs on the target (or remotely with creds). It queries LDAP and produces a zip file.

# Option A: SharpHound.exe (preferred, binary, less likely blocked than PS)
PS> .\SharpHound.exe -c All
[*] Enumerating Domain: corp.local
[*] Status: 150 objects finished (+150) -- Using 42 MB RAM
[*] SharpHound Enumeration Completed! Compressing data to 20241115_BloodHound.zip  <-- this zip is what you drag into the BloodHound GUI

# Option B: SharpHound.ps1 (PowerShell version)
PS> Import-Module .\SharpHound.ps1
PS> Invoke-BloodHound -CollectionMethod All

# Option C: From Kali with credentials (no need to be on the target)
$ bloodhound-python -u user -p 'pass' -d corp.local -ns 10.10.10.10 -c All

The -c All flag collects everything: users, groups, computers, sessions, ACLs, trusts, GPOs, object properties. Always use All unless you have a specific reason not to (like stealth).

Part 3: Importing and analyzing

1. Transfer the zip file to your Kali box
2. In BloodHound GUI: click the upload icon (top right) → select the zip
3. Wait for import to complete
4. Start querying

Essential queries to run (in order)

# These are in the "Analysis" tab, click each one

1. Find all Domain Admins
2. Find Shortest Paths to Domain Admins
3. Shortest Paths to Domain Admins from Kerberoastable Users
4. Shortest Paths to Unconstrained Delegation Systems
5. Shortest Paths from Domain Users to High Value Targets
6. Find Principals with DCSync Rights
7. Users with Foreign Domain Group Membership
8. Find Computers where Domain Users are Local Admin

Marking owned users

As you compromise accounts, mark them as "owned" in BloodHound. Right-click the user node → "Mark as Owned". Then query "Shortest Paths from Owned Principals", BloodHound recalculates routes from your current position.

Reading the graph

Each line (edge) in the graph represents a relationship you can exploit:

What do you do with the output?

BloodHound shows you the path, but you still need to exploit each step. For each edge in the graph, use the corresponding tool:

• GenericAll/GenericWrite on a user? → bloodyAD to set SPN or change password
• Kerberoastable user in the path? → Rubeus to get the hash, Hashcat to crack
• DA session on a workstation? → Get on that box, use Mimikatz to steal the ticket
• WriteDACL? → bloodyAD or PowerView to grant yourself full control
• Unconstrained delegation? → Coerce authentication with SpoolSample/PetitPotam, capture TGT
• DCSync rights? → secretsdump to dump all domain hashes

Common mistakes

Check yourself

Answer each question out loud or on paper first, then open it. Retrieving the answer teaches you more than rereading the page.