SharpHound
BloodHound's official collector: dumps the AD graph for analysis.
BloodHound's official collector. It queries the domain over LDAP and SMB and produces the JSON (users, groups, ACLs, sessions, delegations, GPOs) that you then import into the UI to draw the attack-path graph. It exists in C# (for Windows) and as bloodhound-python to run from Linux.
Family Active Directory enumeration
Flags -c All --zipfilename
Concepts BloodHound, ACL Abuse (DACL)
Cheatsheet Enumeration
Installation
# Windows collector. Ships with BloodHound CE (Download Collectors) or from the repo:Useful commands
Reference tool: it does not yet appear in a published machine on the blog, but it is part of the arsenal for its everyday use.