Home > Network Pentesting

BloodHound

BloodHound is a graph-based Active Directory (AD) attack-mapping tool used to visualize privilege relationships, find hidden paths to domain admin, and identify misconfigurations that enable lateral movement and privilege escalation. It collects AD data through SharpHound and displays it as an interactive attack graph. BloodHound has become one of the most important tools for internal network pentesting.

Understanding BloodHound’s Role

BloodHound helps pentesters:

  • Map user, group, and computer relationships

  • Identify privilege escalation paths

  • Find attack chains to Domain Admin

  • Detect misconfigurations (e.g., unconstrained delegation)

  • Visualize rights such as RDP, DCOM, WMI, GPO control

  • Spot vulnerable ACLs and object permissions

  • Track lateral movement possibilities

  • Analyze domain trust relationships

BloodHound turns complex AD structures into clear, actionable attack routes.

Components of BloodHound

BloodHound consists of:

  • BloodHound GUI – The interface for graph exploration

  • Neo4j Database – Stores AD relationship data

  • SharpHound – Collector that extracts domain information

Pentesters run SharpHound on a compromised machine and import results into BloodHound.

Installing BloodHound

Install Neo4j Database

sudo neo4j start

Access the console:

http://localhost:7474

Launch BloodHound

bloodhound

Login with the Neo4j credentials.

Collecting Data with SharpHound

SharpHound gathers domain information through LDAP queries, SMB enumeration, and session mapping.

SharpHound PowerShell Ingestor

Import-Module .\SharpHound.ps1
Invoke-BloodHound -CollectionMethod All

EXE Ingestor

SharpHound.exe --collectionmethod All --domain corp.local

Output

SharpHound creates .zip files containing JSON data.

Import these into the BloodHound GUI:

  • Click “Upload Data”

  • Select ZIP files

Data populates the graph automatically.

Key BloodHound Data Types

BloodHound tracks AD object relationships:

  • Users

  • Groups

  • Computers

  • OUs

  • GPOs

  • Sessions

  • ACLs

  • Domain trusts

These form edges in the attack graph.

Essential Attack Paths

1. Path to DA (Domain Admin)

Use:

Shortest Path to Domain Admins

Shows the fastest route to domain dominance.

2. Local Admin Rights

Check:

Find Local Admin Rights

If you have admin on workstation A → you may pivot into workstation B.

3. Domain-Wide RDP Access

Look for RDP rights:

  • CanRDP

  • ForceChangePassword

  • ExecuteDCOM

  • AllowedToDelegate

These often expose privilege escalation.

4. Unconstrained Delegation

Nodes with unconstrained delegation allow automatic ticket harvesting.

Look for:

Unconstrained Delegation

5. Kerberoastable Accounts

BloodHound identifies SPNs that can be cracked.

Path:

Find Kerberoastable Users

6. GPO Abuse

GPO misconfigurations often allow privilege escalation.

Look for:

WriteGPO
WriteDACL

These allow an attacker to modify policy affecting privileged hosts.

7. Abuse of ACL Permissions

AD objects often have unnecessary permissions assigned.

Key edges:

  • GenericWrite

  • GenericAll

  • WriteOwner

  • WriteDACL

These allow:

  • Adding yourself to privileged groups

  • Resetting passwords

  • Gaining admin privileges

Running Queries in BloodHound

Custom Queries Panel

Use saved queries such as:

  • Find all machines where a user is admin

  • Find all computers with unconstrained delegation

  • Find dangerous ACL relationships

  • Identify attack paths from compromised user

Example Query: Users with DCSync Rights

MATCH (n)-[:CanDCSync]->(m) RETURN n,m

DCSync allows dumping the NTDS hashes without domain admin.

Exploiting Common Misconfigurations

Abusing GenericWrite

Reset password:

net user victim NewPass123!

Abusing Local Admin Access

Use:

winrm / evil-winrm
cme smb

Abusing RDP Access

Connect via:

xfreerdp /v:10.10.20.5

Abusing GPO Control

Inject startup scripts or add users.

Abusing Kerberoastable Accounts

Crack tickets offline.

Visualizing Attack Chains

BloodHound provides color-coded, directional graphs that show:

  • Which accounts you control

  • What privileges you gain next

  • Final goal: domain or enterprise admin

Nodes and edges clearly highlight lateral movement steps.

Maintaining BloodHound Data

For large engagements:

  • Run SharpHound multiple times

  • Merge multiple ingestions

  • Use tags to mark compromised nodes

  • Use notes to annotate attack steps

  • Track discovered credentials

BloodHound becomes an internal attack dashboard.

Why BloodHound Mastery Matters

BloodHound enables pentesters to:

  • Reveal hidden AD security flaws

  • Turn a single foothold into full domain compromise

  • Understand complex relationships instantly

  • Build actionable escalation chains

  • Document lateral movement paths for reporting

  • Evaluate AD security posture comprehensively

BloodHound transforms Active Directory from a black box into a fully mapped attack surface.

Intel Dump

  • SharpHound collects AD data through LDAP/SMB

  • Import ZIP files into BloodHound GUI

  • Use built-in queries (Paths to DA, Local Admin Rights)

  • Identify Kerberoasting, ACL abuse, delegation flaws

  • Attack chains often involve ACL misconfigs, RDP rights, GPO abuse

  • BloodHound provides full AD attack graph for lateral movement

HOME LEARN COMMUNITY DASHBOARD