BloodHound
Map attack paths.
BloodHound is a free Ethical Hacking Academy lesson on CoddyKit — lesson 4 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Ethical Hacking Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
What Is BloodHound?
BloodHound is a tool that maps relationships in Active Directory as a graph. It reveals hidden attack paths from a low-privileged user to high-value targets like Domain Admin.
What humans miss in complex permission tangles, BloodHound finds with graph theory.
Nodes and Edges
BloodHound models AD as nodes (users, groups, computers, OUs, GPOs) connected by edges (relationships).
Edges represent rights such as MemberOf, AdminTo, HasSession, or GenericAll. A chain of edges is an attack path.
The Collector: SharpHound
SharpHound is the data collector. Run from a domain-joined context, it queries LDAP and other sources to gather objects, group memberships, sessions, and ACLs.
It outputs JSON (zipped) that you then import into the BloodHound interface.
SharpHound.exe -c All --zipfilename loot.zipCollection Methods
SharpHound supports several collection methods via -c:
- Group: group memberships.
- Session: who is logged in where.
- ACL: object permissions.
- All: everything (noisier, more complete).
Loud collection risks detection, so attackers may stagger or scope it.
Python and Remote Collection
If you cannot run SharpHound on Windows, bloodhound-python collects remotely over LDAP using domain credentials.
This is ideal from a Linux attack box during an assumed-breach test.
bloodhound-python -u lowuser -p Password1 -d corp.local -ns 10.0.0.10 -c AllImporting Data
BloodHound uses a Neo4j graph database as its backend. You start Neo4j, log into the BloodHound GUI, and drag the collected zip into the interface to import.
Once imported, you can run prebuilt queries or write your own in Cypher.
Prebuilt Analysis Queries
BloodHound ships with powerful canned queries, such as:
- Shortest Paths to Domain Admins.
- Find Principals with DCSync Rights.
- Kerberoastable Accounts.
Marking your current user as 'Owned' lets BloodHound compute paths starting from what you control.
Reading Attack Paths
An attack path might read: your user is MemberOf a group that has GenericAll over another user who is AdminTo a server where a Domain Admin has a session.
Each edge tells you the exact technique needed for the next hop, turning a graph into a step-by-step plan.
Dangerous ACL Edges
Some of the most abused edges are ACL-based rights:
- GenericAll / GenericWrite: full or broad write over an object.
- WriteDacl / WriteOwner: take control of an object's permissions.
- ForceChangePassword: reset a target's password.
These let you escalate without ever cracking a hash.
Cypher Queries
For custom analysis you can write Cypher, Neo4j's query language. This lets you hunt for specific conditions the built-in queries do not cover.
For example, finding all users with a path to a sensitive server.
MATCH p=shortestPath((u:User {owned:true})-[*1..]->(g:Group {name:'DOMAIN ADMINS@CORP.LOCAL'})) RETURN pDefensive Use
BloodHound is not only an attacker tool. Defenders run it to audit their own AD, find unintended attack paths, and prune dangerous permissions before adversaries exploit them.
Tightening ACLs, removing stale admin rights, and limiting session exposure all shrink the graph an attacker could traverse.
Quick Check
Recall the role of SharpHound.
Recap
You now understand BloodHound:
- It models AD as a graph of nodes and relationship edges.
- SharpHound (or bloodhound-python) collects the data into a Neo4j-backed GUI.
- Prebuilt and Cypher queries reveal shortest paths to Domain Admin.
- ACL edges like GenericAll and WriteDacl enable escalation without cracking.
You have completed the Active Directory Attacks course.
Frequently asked questions
Is the “BloodHound” lesson free?
Yes — the full text of “BloodHound” is free to read here on the web, and the Ethical Hacking Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Ethical Hacking Academy course, upgrade to CoddyKit PRO.
What will I learn in “BloodHound”?
Map attack paths. You practise Ethical Hacking Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start Ethical Hacking Academy?
No prior experience is required. Ethical Hacking Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 4 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “BloodHound” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this Ethical Hacking Academy lesson?
Yes. Every Ethical Hacking Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.