bloodhound-python
BloodHound ingestor from Linux, no Windows agent needed.
The BloodHound collector written in Python, to run from the attacking machine without uploading a binary to Windows. Given domain credentials it queries the controller's LDAP and SMB, gathers users, groups, sessions, ACLs and trust relationships, and leaves the JSON ready to import into the BloodHound interface. It is the usual way to collect the graph when the foothold is a Linux shell or you only have credentials: it touches no disk on the target.
Family Active Directory enumeration
Flags -u -p -d -ns -c All
Concepts BloodHound, ACL Abuse (DACL), LDAP Enumeration
Cheatsheet Enumeration
Installation
# The Python collector MUST match the BloodHound version (their outputs are incompatible):
pipx install bloodhound-ce # BloodHound CE -> comando 'bloodhound-ce-python'
pipx install bloodhound # BloodHound 4.2/4.3 -> comando 'bloodhound-python'
# with pipx you can keep both at once (each in its own isolated venv)Useful commands
Appears in
Some machines where its use is documented; not an exhaustive list.