> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/internal-and-external-network-sec/active-directory-domain-controller/privesc-tools/bloodhound.md).

# BloodHound

**BloodHound** uses graph theory to reveal hidden relationships and attack paths in an Active Directory environment. It helps pentesters and red teamers identify privilege escalation paths and lateral movement opportunities.

**GitHub Repository And Documentation:**

* <https://github.com/SpecterOps/BloodHound>
* <https://bloodhound.specterops.io/get-started/introduction>

***

## Installation and Setup

* **Update Machine**

  ```bash
  sudo apt update && sudo apt upgrade -y
  ```
* **Install Neo4j**

  BloodHound uses **Neo4j** as its database backend.

  ```bash
  sudo apt install neo4j -y
  ```
* **Start Neo4j:**

  ```bash
  sudo neo4j start
  ```
* **Set initial credentials** Open:

  ```
  http://localhost:7474
  ```

  Default login:

  ```
  Username: neo4j
  Password: neo4j
  ```

  You’ll be prompted to set a **new password**.
* **Install BloodHound Community Edition**

  ```bash
  sudo apt install bloodhound -y
  ```

  **Run BloodHound for the first time** (Using sudo ensures it can run the setup script)

  ```bash
  sudo bloodhound
  ```

  You’ll be asked:

  ```
  Do you want to run bloodhound-setup now? [Y/n]
  ```

  Type **Y**.

  A browser will open for Neo4j login. If you log in here, BloodHound will store the credentials (`neo4j` / `neo4j` by default) in:

  ```
  /etc/bhapi/bhapi.json
  ```
* **Fix Stored Neo4j Password**

  If you changed the Neo4j password earlier, update it in the config file:

  ```bash
  sudo vim /etc/bhapi/bhapi.json
  ```

  Edit the `"password"` field to match your Neo4j password, save, and exit.
* **Start BloodHound**

  ```bash
  bloodhound
  ```
* **Access BloodHound UI**

  ```
  http://127.0.0.1:8080/ui
  ```
* Default BloodHound UI login:

  ```
  Username: admin
  Password: admin
  ```

  You’ll be prompted to change your password:

  ```
  [existing password]  admin
  [new password]       MyStrongPass123!
  [confirm password]   MyStrongPass123!
  ```