Active Directory graph-based enumeration tool that maps relationships between users, groups, computers, and permissions to identify attack paths to domain privilege escalation.
bloodhound-python -d {domain} -u {username} -p {password} -ns {nameserver} -c {collection-method} 🌍 domain → domain 🌍 username → user 📎 password 🌍 nameserver → ip 📎 collection-method bloodhound-python -d {domain} -u {username} -p {password} -ns {nameserver} -c {collection-method}Sandbox: execFile · Timeout: 600s
security.ad.enum.users security.ad.enum.groups security.ad.enum.computers security.ad.enum.gpos security.ad.enum.ous security.ad.attackpath security.ad.kerberosabuse security.ad.aclanalysis security.ad.sessioncollection | Name | Type | Required | Default | Description | Aliases |
|---|---|---|---|---|---|
target | string | Yes | - | Target domain controller IP or domain | - |
username | string | Yes | - | Domain username | - |
password | string | Yes | - | Domain password | - |
domain | string | No | - | Domain name (auto-detected if omitted) | - |
nameserver | string | No | - | DNS server IP for domain resolution | - |
collection-method | string | No | all | Collection method: all, group, session, computeronly, etc. | - |
Inputs
network.target.ip Domain controller or target IP
credential.username Domain username
credential.password Domain password
Outputs
security.ad.graph BloodHound JSON files (users/groups/computers/sessions)
network_traffic Produces
security.ad.graphConsumes
network.target.ipcredential.usernamecredential.password| Resource | Value |
|---|---|
| CPU | low |
| Memory | 256 MB |
| Network | medium |
| Disk I/O | medium |
Full AD enumeration with all collection methods
bloodhound-python -d {{DOMAIN}} -u {{USER}} -p '{{PASSWORD}}' -ns {{IP}} -c allKerberos-based enumeration (no password needed on Linux)
bloodhound-python -d {{DOMAIN}} -u {{USER}} -k -no-pass -ns {{IP}} -c allBloodHound.py remote ingestion from LDAP (no credentials)
bloodhound.py -c LDAP -d evilcorp.local -dc-ip 10.10.10.1 -ns 10.10.10.1BloodHound.py with credentials via LDAP
bloodhound.py -u john -p password123 -d evilcorp.local -dc-ip 10.10.10.1 -ns 10.10.10.1 -c AllSharpHound.exe PowerShell execution on Windows
Invoke-BloodHound -CollectionMethod All -Domain evilcorp.local -ZipFile output.zipBloodHound is a single-page JavaScript web application that uses graph theory to reveal hidden relationships and attack paths in Active Directory environments. It ingests LDAP data and session information to build a comprehensive map of who-can-do-what.
| Collector | Platform | Command |
|---|---|---|
| BloodHound.py | Linux | bloodhound-python -d DOMAIN -u USER -p PASS -c all |
| SharpHound.exe | Windows | SharpHound.exe -c All |
| SharpHound.ps1 | PowerShell | Invoke-BloodHound -CollectionMethod All |