BloodHound AD MapperStep-by-step reference: map attack paths in lab Active Directory with BloodHound. Lab only.FAQ

What is BloodHound?

BloodHound is a free, open-source Active Directory analysis platform by SpecterOps. Collectors gather directory data and the interface graphs attack paths, including shortest routes to Domain Admin.

Is using BloodHound legal?

BloodHound itself is legitimate security software. Collecting directory data without explicit written permission is illegal. Use it only in isolated labs like GOAD or signed engagements, and guard collected graphs as sensitive data.

How do I install BloodHound?

Run the Community Edition container with docker and open port 8080. Collect lab data with SharpHound or bloodhound-python, then import the JSON offline.

How do I find the path to Domain Admin?

Mark your owned principal, then run the Shortest Paths to Domain Admins query. Each edge names the technique — follow the chain in the lab and fix every edge as a defender.

What data does collection need?

A lab domain account with read rights, the DC address, and the -c All flag. Run collection while lab users are logged in so session edges appear.

How does BloodHound help defenders?

Every attack edge is a fixable misconfiguration. Removing high-leverage edges — delegation, excess admin rights, flat tiers — breaks the most paths per change.

What is the difference between BloodHound and manual AD recon?

Manual commands answer one question at a time. BloodHound correlates everything into graphs and prebuilt queries, revealing multi-hop paths no manual checklist finds.

Why is my graph empty?

Import all collector JSON files, verify -c All collection, and confirm sessions were captured during active lab logons.

All tools · Sitemap · Games