BloodHound

What is BloodHound?

BloodHound is an open-source tool that analyses the relationships inside an Active Directory domain (and also Azure AD / Entra ID) and represents them as a graph. Instead of checking permissions user by user, BloodHound gathers who can log on where, which groups belong to which, which accounts control others and what delegated permissions exist, and then draws the attack paths: chains of relationships that, strung together, lead from an ordinary user all the way to Domain Admin privileges.

The key idea is that in a large Windows network permissions pile up chaotically over years, and a dangerous path is almost never obvious at a glance. BloodHound uses graph theory to find those paths in seconds. It is used both by offensive teams (red team) for planning and by defensive teams (blue team) to find and close those paths before an attacker does.

What BloodHound is used for

• Auditing your own Active Directory: finding hidden escalation paths and excessive permission configurations.
• Authorised red teaming: identifying the shortest path to Domain Admin during an engagement with written permission.
• Defence (blue/purple team): prioritising which dangerous relationships to fix first and measuring the improvement after changes.
• Training and labs: understanding how privileges propagate in Windows environments.
• Permission inventory: seeing at a glance who really controls critical assets.

BloodHound gathers and visualises directory information. Only run it on your own domains, labs or engagements you have written authorisation for: collecting data from someone else's domain without permission is illegal.

How to install BloodHound

The project has evolved. The modern version, BloodHound Community Edition, is deployed with Docker Compose and ships with a graph database (Neo4j) and a web interface already integrated. The simplest way, following the official docs, is to download the project's docker-compose.yml and bring it up:

curl -L https://ghst.ly/getbhce -o docker-compose.yml
docker compose up

On first start, the console prints a randomly generated initial password; open the web interface at http://localhost:8080 with user admin and that password, then change it. On Kali Linux you will also find the classic package (bloodhound), based on a desktop app and Neo4j, useful for older versions and courses.

BloodHound does not collect the data itself: it needs a collector that you run against the domain, which produces JSON files that you then import into the interface.

How to use BloodHound: practical examples

1. Collect data with SharpHound

On a domain machine (in your lab), the official collector for AD is SharpHound. The usual method gathers the most common information:

SharpHound.exe -c Default

For a more complete collection use the All set, and you can specify the domain explicitly:

SharpHound.exe -c All -d mydomain.local

From Linux there is BloodHound.py (bloodhound-python), which collects data over LDAP with valid credentials for the lab domain:

bloodhound-python -d mydomain.local -u user -p 'Password123' -c All -ns 10.0.0.10

Either one produces a .zip containing several JSON files.

2. Import into BloodHound

In the web interface, go to the data administration section and upload the generated .zip. BloodHound processes the files and builds the graph. Within a few minutes you have the whole directory represented as nodes (users, groups, computers) and edges (relationships).

3. Query attack paths

The most powerful part is the pre-built queries. Some classics:

• Shortest Paths to Domain Admins: the shortest path from any node to a domain administrator.
• Find Principals with DCSync Rights: accounts with permissions that would allow replicating domain secrets.
• Kerberoastable accounts: service accounts that are potentially attackable.
• Shortest Paths from Owned Principals: mark a user as "owned" (compromised) and ask for the path from there toward valuable targets.

You can also write your own queries in Cypher, the graph database language, for very specific questions about your directory.

Defensive use: how the blue team benefits

BloodHound is not only an offensive tool; for an administrator it is an excellent permissions auditor. Run it periodically on your own domain and work through the results:

• Reduce paths to Domain Admin: if dozens of users have a path to DA, you have a permission-design problem.
• Review privileged group memberships and remove the ones no longer needed.
• Fix dangerous delegations and excessive ACL permissions over sensitive accounts.
• Measure progress: collect again after changes and confirm the paths are shorter or gone.

Pro tips

• Mark accounts as "owned" and "high value" so path queries are realistic for your scenario.
• Learn some Cypher: the built-in queries cover the common cases, but the interesting questions about your environment are yours to write.
• Collection is noisy: SharpHound generates many LDAP queries and connections; on real environments it can trigger alerts. Keep that in mind during an authorised exercise.
• Match the version and collector: a SharpHound that is too old or too new may not import cleanly.
• Document: export the relevant graphs for the assessment report.

Pros and cons

Pros	Cons
Finds attack paths invisible at a glance	Learning curve: AD, graphs and Cypher
Useful for both offence and defence	Collection is noisy and triggers alerts
Free and open source (Community Edition)	Requires deploying Docker/Neo4j
Very practical pre-built queries	Data goes stale; you must collect again

BloodHound alternatives

• PingCastle: audits Active Directory security and produces risk-scored reports, very defence-oriented.
• PurpleKnight: an AD/Entra security assessment tool with indicators of exposure.
• ADRecon: gathers domain information into an Excel report, handy for inventory.
• For local enumeration after accessing a machine, pair it with pentest-workflow tooling and AD labs.

Frequently asked questions

Is BloodHound free?

BloodHound Community Edition is free and open source. There is also a commercial (Enterprise) version aimed at continuous monitoring in organisations.

Does BloodHound attack the domain?

No. BloodHound only analyses and visualises data; the information is gathered by the collector (SharpHound or BloodHound.py). The tool itself exploits nothing.

Is it legal to use BloodHound?

Yes, as long as you run it on your own domain, a lab or an engagement authorised in writing. Collecting data from someone else's Active Directory without permission is not.

Do I need to know Active Directory to use it?

Strongly recommended. Without understanding users, groups, ACLs and delegations, the graph will tell you little. Start by building an AD lab and practise there.

What is the difference between SharpHound and BloodHound?

SharpHound is the collector that extracts the data from the domain; BloodHound is the application that imports it, represents it as a graph and lets you query it.

If you want to practise Active Directory in safe, guided environments, the Hackers en Acción Academy has step-by-step labs and challenges.