skills.rest
wgpsec
wgpsecOFFICIAL
Explore all skills by this author →
Website𝕏@wgpsecGitHub

bloodhound-enum

Collects Active Directory users, groups, sessions, ACLs, and trusts via BloodHound.py for attack path analysis.

1.7k|238|Updated Dec 7, 2019
Search Tags:#penetration testing#enumeration#ldap#bloodhound#attack path#Active Directory#Kerberos
One-click install
npx skills add https://github.com/wgpsec/AboutSecurity --skill bloodhound-enum
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: bloodhound-enum
Source: https://github.com/wgpsec/AboutSecurity/tree/main/skills/tool/bloodhound-enum
Command: npx skills add https://github.com/wgpsec/AboutSecurity --skill bloodhound-enum

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

During authorized Active Directory penetration tests, manually enumerating domain users, groups, computers, sessions, ACLs, and trust relationships is slow and error-prone. This Skill provides a structured methodology for using BloodHound.py to remotely collect AD data over LDAP/DNS/Kerberos and output JSON for attack path analysis in the BloodHound GUI.

Core Features & Use Cases

  • Remote Full Collection: Gather users, groups, computers, sessions, ACLs, and trusts without executing anything on the target, using LDAP/DNS/Kerberos protocols.
  • Multiple Authentication Methods: Supports password, NTLM Pass-the-Hash, and Kerberos (including ccache ticket) authentication.
  • Selective Collection Modes: Choose Default, Group, LocalAdmin, Session, ACL, or Trusts collection depending on the engagement phase.
  • Use Case: After obtaining initial domain credentials, run a full collection with bloodhound-python -c All --zip, import the ZIP into the BloodHound GUI with Neo4j, and query shortest paths to Domain Admins or find Kerberoastable users.

Quick Start

Ask the AI to run a full BloodHound.py collection against the domain corp.local with your credentials and import the resulting ZIP into the BloodHound GUI for attack path analysis.

Frequently Asked Questions about bloodhound-enum

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I enumerate Active Directory with BloodHound.py?▼

Run bloodhound-python with the domain, credentials, and a collection method such as -c All to gather users, groups, sessions, ACLs, and trusts remotely over LDAP/DNS. The output JSON or ZIP files are then imported into the BloodHound GUI for analysis.

How to use BloodHound.py with NTLM hash or Pass-the-Hash?▼

Pass the hash with the --hashes flag in LM:NT format, for example --hashes aad3b435b51404eeaad3b435b51404ee:hash, along with -d, -u, and -c All. This authenticates without knowing the plaintext password.

Does BloodHound.py require running code on the target machine?▼

No, BloodHound.py collects data remotely through LDAP, DNS, and Kerberos protocols, so nothing needs to execute on target hosts. You only need valid domain credentials and network access to a domain controller.

What collection methods does BloodHound.py support?▼

It supports Default (Group, LocalAdmin, Session, Trusts), plus individual methods like Group, LocalAdmin, Session, ACL, and Trusts, or All for full collection. Choose narrower methods to reduce noise or time during an engagement.

Why does BloodHound.py fail to connect to the domain controller?▼

Connection failures usually come from DNS resolution issues or unreachable domain controllers. Specify the DC IP with -dc and the DNS server with -ns, and verify credentials and network connectivity to the target domain.

Related Skills

Explore More Software Engineering Skills→
AeonDaveAeonDave
15

kerbrute

Enumerate Active Directory usernames and test passwords via Kerberos pre-authentication.

Community
Intermediate
noname300989noname300989

ad-offensive

Orchestrate Active Directory offensive security operations with BloodHound, Impacket, and CrackMapExec.

Community
Advanced
woohyun212woohyun212
21

ad-pentest

Perform six-phase Active Directory penetration testing with BloodHound and ADCS enumeration.

Community
Advanced
Greg-T8Greg-T8

terraform-ad-lab

Automate Active Directory lab creation on Hyper-V with Terraform.

Community
Advanced