🛠️ BloodHound

Installation

# Collector (no BloodHound GUI needed just to gather data)
pipx install bloodhound
 
# GUI + graph database, for viewing the collected data
sudo apt install bloodhound

Common Commands

CommandDescription
bloodhound-python -u '<user>' -p '<pass>' -d <domain> -ns <dc_ip> -c allCollect AD data remotely, without needing to run anything on a domain-joined host.
SharpHound.exe -c AllCollect AD data from a session on a domain-joined Windows host.
. .\SharpHound.ps1; Invoke-BloodHound -CollectionMethod AllSame collection, run from a PowerShell one-liner/import.

Tips & Tricks

  • Re-run collection after every new credential gained during an engagement — the same environment can look like a dead end from one account and show a direct path to Domain Admin from another, purely based on that principal’s own group memberships and ACEs.
  • Common edges worth specifically searching for: GenericAll/GenericWrite/WriteDacl/WriteOwner on a user, group, computer, or GPO; ForceChangePassword; AddMember; GetChanges+GetChangesAll on the domain object (DCSync rights); and AdminTo edges pointing at unexpected computers.
  • The Cypher query search bar can answer questions the pre-built queries don’t cover, e.g. finding every principal with DCSync rights: MATCH (n)-[:MemberOf|GetChanges|GetChangesAll*1..]->(d:Domain) RETURN n.
FileCreated
HTB - SaunaTuesday, July 21st 2026, 4:41:17 am
HTB - StreamIOJuly 21, 2026

References: BloodHound GitHub