BloodHound for Beginners: Map Active Directory Attack Paths

In a Windows domain, a normal user can sometimes reach Domain Admin through a chain of small permissions nobody noticed. BloodHound turns Active Directory data into a graph that shows those chains. Attackers and defenders both use it. Run it only against your own lab or systems you have written permission to test. First read Active Directory attacks explained.

Build a Lab

You need an Active Directory domain you own: a Windows Server virtual machine as domain controller, a Windows client and a Linux attacker VM. A practice lab project such as GOAD builds one for you. In the examples, the domain is lab.local and the controller is 192.168.56.10.

Collect Data

From the Linux VM, with a low-privilege lab account, the Python collector gathers data over the network:

• bloodhound-python -u labuser -p "LabPassword1" -d lab.local -ns 192.168.56.10 -c All --zip

It writes a zip file of JSON data. Collection is noisy in logs, which is what a defender should detect.

Load and Query

• Install BloodHound Community Edition by following the project's documentation (it runs in Docker).
• Upload the zip file in the interface.
• Run the built-in queries: shortest paths to Domain Admins, Kerberoastable users, users with unconstrained delegation.
• Click each edge in a path to read what permission it represents and why it works.

Use It as a Defender Too

Every path BloodHound shows is something to fix: remove an over-broad group membership, tighten a permission, protect a service account with a long password. Run it before attackers do and keep the findings in your report; see how to write a penetration testing report.

Where It Fits

Active Directory testing is a core part of our Network and AD penetration testing course and a large part of EC-Council's CPENT; see the CPENT exam guide. For lateral movement across networks, read pivoting explained.

Sources and Further Reading

• BloodHound documentation