arsenal/BloodHound

BloodHound

AD attack-path graphing · GPL-3.0

Maps Active Directory relationships into a graph to reveal privilege-escalation and lateral-movement paths. Collectors run from the host; the analyzer is a GUI.

Authorized use only. Run these only on systems you own or have explicit written permission to test. Full notice at the foot of the page.

01Seeing AD as the graph it really is

Active Directory is a web of relationships: who is in which group, who can reset whose password, which accounts are admin on which machines, who can act on whom. Nobody can hold that web in their head past a few dozen objects, and attackers exploit exactly the paths defenders cannot see. BloodHound collects all those relationships and renders them as a graph, then answers the question that matters: from where I am now, what is the shortest path to domain admin. It turns an invisible tangle into a picture you can reason about, which is as powerful for defenders as for attackers.

↑ contents

02Install the analyzer

BloodHound has two parts: a collector that gathers the data, and the analyzer that graphs it. The analyzer is a GUI application (BloodHound Community Edition) backed by a graph database. This is a case where the GUI is the whole value: the graph is the product, and you explore it visually.

$ # BloodHound Community Edition runs via Docker Compose on any distro;

$ # see github.com/SpecterOps/BloodHound for the current compose file.

$ pipx install bloodhound-ce # the Python collector (any distro)

03Gathering the data

The collector queries the domain and writes JSON files that you import into the analyzer. SharpHound is the Windows collector; from Linux, bloodhound-python collects remotely with a credential, which fits the rest of this toolkit. One run captures the whole directory structure.

$ bloodhound-python -u alice -p 'Summer2026!' -d corp.local -ns 10.0.0.10 -c All

04Loading and reading the graph

Drag the collected zip into the analyzer and it builds the graph. Then you query it. The pre-built queries are where most of the value is: shortest paths to domain admin, who can DCSync, where high-value accounts are logged in, Kerberoastable users. Each query draws the paths as a diagram you can follow node by node.

05What the paths tell you

A path is a chain of abusable relationships: alice is in group X, group X can reset the password of bob, bob is admin on the DC. Each hop is an action from this toolkit (a password reset, a Kerberoast, a pass-the-hash), and the chain is the attack plan. Seeing it drawn is what makes a non-obvious escalation obvious.

» The famous BloodHound query, shortest path to Domain Admins, often reveals a three-hop chain through relationships nobody intended, which no amount of per-object review would have caught.

↑ contents

06Cutting the paths

BloodHound is arguably more valuable to defenders, because it shows you the attack paths while you still have time to cut them. Run it against your own domain and work the shortest paths to your crown jewels, removing one relationship in each chain until the path disappears. This is proactive AD hardening guided by the attacker's own map.

» Attack the shortest paths first: break one link in each chain to domain admin and the whole path dies.

» Over-privileged groups and nested group membership create most unintended paths; prune membership to least privilege.

» Dangerous rights (GenericAll, password-reset, DCSync) on the wrong principals are common findings; remove or tightly scope them.

» Reduce where high-value accounts log in; a domain admin session on a workstation is a path waiting to be taken.

» Re-collect after changes and confirm the paths are gone; make it a periodic review, because AD drifts back toward sprawl.

» This closes the Active Directory group: impacket and netexec and responder are the moves, and BloodHound is the map that shows where they lead. Learn the map as a defender and you can shut the moves down before anyone makes them.

↑ contents