BloodHound
Maps relationships and attack paths in Active Directory.
Maps Active Directory as a graph and reveals attack paths you cannot see by hand: who has GenericAll over whom, which user reaches Domain Admin by chaining permissions. A collector (bloodhound-python, SharpHound or netexec) gathers the data and the UI explores it with prebuilt queries.
Family Active Directory enumeration
Flags -c all -d -u -p
Concepts BloodHound, ACL Abuse (DACL), Kerberoasting, GenericAll, ForceChangePassword, WriteDACL, WriteOwner, GPO abuse (SharpGPOAbuse, Restricted Groups), LAPS (Local Administrator Password Solution), Account Operators group abuse, DCSync
Cheatsheet Enumeration
Installation
# --- BloodHound CE: interfaz web moderna sobre Postgres + Neo4j, via Docker ---
# 1) Requirements: Docker + Compose v2 (one time only):
sudo apt install -y docker.io docker-compose-v2 && sudo systemctl enable --now docker
sudo usermod -aG docker $USER # log out and back in to use docker without sudo
# 2) Download the official BloodHound CE docker-compose.yml:
curl -L https://ghst.ly/getbhce -o docker-compose.yml
# 3) Bring up the stack (Postgres, Neo4j and the web UI):
docker compose up -d
# 4) The initial 'admin' password is printed in the logs on the first run:
docker compose logs bloodhound | grep -i 'Initial Password'
# 5) Open http://localhost:8080 , log in as admin and change the password
# --- data collector: MUST match the BloodHound version ---
pipx install bloodhound-ce # provides 'bloodhound-ce-python' (collector for BloodHound CE)
# NOTE: 'pipx install bloodhound' (bloodhound-python) is the LEGACY collector (BloodHound 4.2/4.3)
# and its output is NOT ingested by BloodHound CE. With pipx you can keep both at once (isolated venvs).
# SharpHound.exe also ships in the BloodHound CE UI itself (Download Collectors)Useful commands
Appears in
Some machines where its use is documented; not an exhaustive list.