skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

conducting-internal-reconnaissance-with-bloodhound-ce

Maps Active Directory attack paths using BloodHound CE graph analysis and SharpHound collection.

954|172|Updated Mar 13, 2026
Search Tags:#reconnaissance#red-team#privilege-escalation#Active-Directory#attack-paths#bloodhound#sharpHound
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill conducting-internal-reconnaissance-with-bloodhound-ce
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: conducting-internal-reconnaissance-with-bloodhound-ce
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/red-teaming/conducting-internal-reconnaissance-with-bloodhound-ce
Command: npx skills add https://github.com/xalgord/xalgorix --skill conducting-internal-reconnaissance-with-bloodhound-ce

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

After gaining an initial foothold in an Active Directory environment, red teamers struggle to identify which misconfigurations, ACLs, and sessions actually lead to Domain Admin. This Skill guides the full BloodHound CE workflow so hidden privilege escalation chains become visible and actionable.

Core Features & Use Cases

  • BloodHound CE Deployment: Stand up the Docker Compose-based BloodHound CE server and configure initial access.
  • Data Collection: Gather AD objects, sessions, ACLs, and trusts using SharpHound v2, BloodHound.py, or AzureHound, with stealth-aware options like DCOnly and session looping.
  • Attack Path Analysis: Run built-in queries and custom Cypher to find shortest paths to Domain Admin, Kerberoastable accounts, DCSync rights, delegation abuse, and LAPS exposure.
  • Use Case: During an internal penetration test, collect AD data from a compromised workstation, import it into BloodHound CE, mark owned principals, and produce a prioritized list of exploitable paths to Domain Admins for the engagement report.

Quick Start

Deploy BloodHound CE with Docker Compose, collect domain data with SharpHound, import it, and show me the shortest attack paths from my owned accounts to Domain Admins.

Frequently Asked Questions about conducting-internal-reconnaissance-with-bloodhound-ce

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find attack paths to Domain Admin with BloodHound CE?▼

Import SharpHound-collected data into BloodHound CE, mark compromised accounts as Owned, then run the built-in Shortest Path to Domain Admin query or a custom Cypher shortestPath query from owned nodes to the Domain Admins group.

What is the difference between SharpHound -c All and -c DCOnly?▼

DCOnly performs LDAP-only collection against domain controllers, making it much stealthier. All additionally touches every host for session and local admin enumeration, which is noisier but reveals session-based attack paths.

Can I collect BloodHound data from Linux instead of Windows?▼

Yes, BloodHound.py (bloodhound-python) collects AD data from Linux using domain credentials and a nameserver. For Azure AD or Entra ID environments, use AzureHound instead of SharpHound.

Why does BloodHound show no path to Domain Admin?▼

Missing paths usually mean incomplete collection: session looping was skipped, owned principals were not marked, or only built-in queries were run. Run session collection with --loop and custom Cypher for ACL and DCSync edges before concluding no path exists.

Does BloodHound CE work with the legacy SharpHound collector?▼

BloodHound CE requires SharpHound v2, which generates data in the format its PostgreSQL-backed ingest expects. Legacy SharpHound output targets the old Neo4j-based BloodHound and is not compatible with CE.

Related Skills

Explore More Software Engineering Skills→
Kisilev13Kisilev13

okta-attack

Identify and exploit vulnerabilities in Okta-based IAM systems.

Community
Advanced
noname300989noname300989

ad-offensive

Orchestrate Active Directory offensive security operations with BloodHound, Impacket, and CrackMapExec.

Community
Advanced
SkobynSkobyn

m365-entra-attack

Identify and exploit Microsoft 365 and Entra ID credential attack vulnerabilities.

Community
Advanced
brucesongsbrucesongs
60

ad-ldap-attack

Enumerate Active Directory LDAP environments to reveal users, groups, SPNs, and credential artifacts.

Community
Advanced