#### Intelligence Brief: At a Glance

          __
     (___()'`;
     /,    /`
     \\"--\\

Core Function: `bloodhound.py` is a Python-based data ingestor for the BloodHound analysis tool, designed to enumerate Active Directory environments without relying on the C#-based SharpHound collector.

Primary Use-Cases:

- Mapping Active Directory domain trust relationships.

- Identifying privilege escalation paths and attack vectors.

- Enumerating users, groups, computers, sessions, and access control lists (ACLs).

- Performing situational awareness during internal penetration tests.

- Visualizing complex AD permissions and group memberships.

Penetration Testing Phase: Post-Exploitation, Internal Reconnaissance, Privilege Escalation.

Brief History: Developed by Dirk-jan Mollema, `bloodhound.py` provides a flexible, cross-platform alternative to the official SharpHound ingestor. It leverages the Impacket library for network protocol interactions, making it a staple in the toolkit of penetration testers who prefer or are limited to non-Windows environments.

#### Initial Engagement: Installation & Verification

This section covers the basic commands to ensure `bloodhound.py` is correctly installed and ready for operation. All commands are assumed to be run within a Kali Linux or similar Debian-based penetration testing distribution.

#### Objective: Check if bloodhound.py is Installed

This command uses the `apt` package manager to search for the `bloodhound.py` package.

Command:

Bash

    apt search bloodhound.py

Command Breakdown:

- `apt`: The command-line tool for managing packages.

- `search`: The action to search for a package by name.

- `bloodhound.py`: The name of the package to find.

Ethical Context & Use-Case: Before attempting to install a tool, it is best practice to verify if it is already present on the system or available in the configured repositories. This prevents redundant installations and helps in identifying the correct package name.

--> Expected Output:

    Sorting... Done
    Full Text Search... Done
    bloodhound.py/kali-rolling,kali-rolling 1.8.0-0kali1 all
      Python based ingestor for BloodHound (Python 3)

#### Objective: Install bloodhound.py

This command installs the tool using the system's package manager.

Command:

Bash

    sudo apt install bloodhound.py -y

Command Breakdown:

- `sudo`: Executes the command with superuser privileges.

- `apt install`: The command to install a package.

- `bloodhound.py`: The package to be installed.

- `-y`: Automatically answers "yes" to any prompts during installation.

Ethical Context & Use-Case: During the setup phase of a penetration test, an ethical hacker must ensure all necessary tools are installed on their attack machine. This command securely and efficiently installs `bloodhound.py` from the official Kali repositories.

--> Expected Output:

    Reading package lists... Done
    Building dependency tree... Done
    Reading state information... Done
    The following NEW packages will be installed:
      bloodhound.py
    0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded.
    Need to get 67.2 kB of archives.
    After this operation, 351 kB of additional disk space will be used.
    Get:1 http://kali.download/kali kali-rolling/main amd64 bloodhound.py all 1.8.0-0kali1 [67.2 kB]
    Fetched 67.2 kB in 1s (86.3 kB/s)
    Selecting previously unselected package bloodhound.py.
    (Reading database ... 312543 files and directories currently installed.)
    Preparing to unpack .../bloodhound.py_1.8.0-0kali1_all.deb ...
    Unpacking bloodhound.py (1.8.0-0kali1) ...
    Setting up bloodhound.py (1.8.0-0kali1) ...

#### Objective: View the Help Menu

Displaying the help menu is the first step in understanding a tool's capabilities.

Command:

Bash

    bloodhound-python -h

Command Breakdown:

- `bloodhound-python`: The executable for the tool. Note the hyphen, which is different from the package name.

- `-h` or `--help`: The standard flag to display the help message and exit.

Ethical Context & Use-Case: Ethical hackers must have a thorough understanding of their tools. Reviewing the help menu is critical for learning the available options, syntax, and collection methods, ensuring that data collection is precise and aligned with the engagement's scope.

--> Expected Output:

    usage: bloodhound-python [-h] [-c COLLECTIONMETHOD] [-d DOMAIN] [-v]
                             [-u USERNAME] [-p PASSWORD] [-k] [--hashes HASHES]
                             [-no-pass] [-aesKey hex key]
                             [--auth-method {auto,ntlm,kerberos}] [-ns NAMESERVER]
                             [--dns-tcp] [--dns-timeout DNS_TIMEOUT] [-dc HOST]
                             [-gc HOST] [-w WORKERS] [--exclude-dcs]
                             [--disable-pooling] [--disable-autogc] [--zip]
                             [--computerfile COMPUTERFILE] [--cachefile CACHEFILE]
                             [--ldap-channel-binding] [--use-ldaps]
                             [-op PREFIX_NAME]

    Python based ingestor for BloodHound LEGACY
    For help or reporting issues, visit https://github.com/dirkjanm/BloodHound.py

    options:
      -h, --help            show this help message and exit
      -c, --collectionmethod COLLECTIONMETHOD
                            Which information to collect. Supported: Group,
                            LocalAdmin, Session, Trusts, Default (all previous),
                            DCOnly (no computer connections), DCOM, RDP,PSRemote,
                            LoggedOn, Container, ObjectProps, ACL, All (all except
                            LoggedOn). You can specify more than one by separating
                            them with a comma. (default: Default)
      -d, --domain DOMAIN   Domain to query.
      -v                    Enable verbose output

    authentication options:
      Specify one or more authentication options.
      By default Kerberos authentication is used and NTLM is used as fallback.
      Kerberos tickets are automatically requested if a password or hashes are specified.

      -u, --username USERNAME
                            Username. Format: username[@domain]; If the domain is
                            unspecified, the current domain is used.
      -p, --password PASSWORD
                            Password
      -k, --kerberos        Use kerberos ccache file
      --hashes HASHES       LM:NLTM hashes
      -no-pass              don't ask for password (useful for -k)
      -aesKey hex key       AES key to use for Kerberos Authentication (128 or 256
                            bits)
      --auth-method {auto,ntlm,kerberos}
                            Authentication methods. Force Kerberos or NTLM only or
                            use auto for Kerberos with NTLM fallback

    collection options:
      -ns, --nameserver NAMESERVER
                            Alternative name server to use for queries
      --dns-tcp             Use TCP instead of UDP for DNS queries
      --dns-timeout DNS_TIMEOUT
                            DNS query timeout in seconds (default: 3)
      -dc, --domain-controller HOST
                            Override which DC to query (hostname)
      -gc, --global-catalog HOST
                            Override which GC to query (hostname)
      -w, --workers WORKERS
                            Number of workers for computer enumeration (default:
                            10)
      --exclude-dcs         Skip DCs during computer enumeration
      --disable-pooling     Don't use subprocesses for ACL parsing (only for
                            debugging purposes)
      --disable-autogc      Don't automatically select a Global Catalog (use only
                            if it gives errors)
      --zip                 Compress the JSON output files into a zip archive
      --computerfile COMPUTERFILE
                            File containing computer FQDNs to use as allowlist for
                            any computer based methods
      --cachefile CACHEFILE
                            Cache file (experimental)
      --ldap-channel-binding
                            Use LDAP Channel Binding (will force ldaps protocol to
                            be used)
      --use-ldaps           Use LDAP over TLS on port 636 by default
      -op, --outputprefix PREFIX_NAME
                            String to prepend to output file names

#### Tactical Operations: Core Commands & Use-Cases

This section provides an exhaustive list of commands, demonstrating the full range of `bloodhound.py` capabilities. Each example is presented within an ethical hacking context on a network you have explicit permission to test. For all examples, we will assume the target domain is `CORP.LOCAL` and we have valid credentials for the user `lowpriv`.

#### Basic Collection Methods

#### Objective: Basic Run with Username and Password (Default Collection)

Command:

Bash

    bloodhound-python -u lowpriv -p 'Password123!' -d CORP.LOCAL -ns 10.10.10.5

Command Breakdown:

- `-u lowpriv`: Specifies the username `lowpriv`.

- `-p 'Password123!'`: Provides the password for the user.

- `-d CORP.LOCAL`: Sets the target domain.

- `-ns 10.10.10.5`: Specifies the IP address of the Domain Name Server.

Ethical Context & Use-Case: This is the most common starting point. After gaining initial access with a low-privilege user account, the first step is to map the domain. The 'Default' collection method gathers group memberships, local admin rights, user sessions, and domain trusts, providing a foundational data set for analysis in the BloodHound GUI.

--> Expected Output:

    INFO: Found domain: CORP.LOCAL
    INFO: Connecting to LDAP server: dc01.corp.local
    INFO: Found 2 domains
    INFO: Found 52 users
    INFO: Found 12 groups
    INFO: Found 15 computers
    INFO: Starting computer enumeration with 10 workers
    INFO: Querying computer: web01.corp.local
    INFO: Querying computer: sql01.corp.local
    ...
    INFO: Computer enumeration finished. Found 15 computers. 0 errors.
    INFO: Starting processing of data, this may take a while
    INFO: Processing computer data
    INFO: Processing user data
    INFO: Processing group data
    INFO: Processing domain data
    INFO: Done! Enjoy your logs!

#### Objective: Collect Only Group Membership Data

Command:

Bash

    bloodhound-python -c Group -u lowpriv -p 'Password123!' -d CORP.LOCAL -ns 10.10.10.5

Command Breakdown:

- `-c Group`: Specifies the collection method. In this case, only collect group membership information.

- `-u`, `-p`, `-d`, `-ns`: Standard authentication and targeting parameters.

Ethical Context & Use-Case: In a highly sensitive environment, a penetration tester might want to minimize their network footprint. A 'Group' only collection is a low-impact query that focuses solely on enumerating groups and their members. This can quickly reveal over-privileged users or misconfigured group memberships without touching individual computers for session or local admin data.

--> Expected Output:

    INFO: Found domain: CORP.LOCAL
    INFO: Connecting to LDAP server: dc01.corp.local
    INFO: Found 52 users
    INFO: Found 12 groups
    INFO: Starting processing of data, this may take a while
    INFO: Processing group data
    INFO: Processing user data
    INFO: Done! Enjoy your logs!

#### Objective: Collect Only Local Admin Rights

Command:

Bash

    bloodhound-python -c LocalAdmin -u lowpriv -p 'Password123!' -d CORP.LOCAL -ns 10.10.10.5

Command Breakdown:

- `-c LocalAdmin`: Sets the collection method to only enumerate members of the local Administrators group on domain computers.

Ethical Context & Use-Case: Finding where users have local admin rights is a primary goal for lateral movement. This targeted scan connects to each computer in the domain and queries for members of the local 'Administrators' group. This data is critical for identifying paths where a compromised user can gain administrative access to another machine.

--> Expected Output:

    INFO: Found domain: CORP.LOCAL
    INFO: Connecting to LDAP server: dc01.corp.local
    INFO: Found 15 computers
    INFO: Starting computer enumeration with 10 workers
    INFO: Querying computer: web01.corp.local for local admins
    INFO: Querying computer: sql01.corp.local for local admins
    ...
    INFO: Computer enumeration finished. Found 15 computers. 0 errors.
    INFO: Starting processing of data, this may take a while
    INFO: Processing computer data
    INFO: Done! Enjoy your logs!

#### Objective: Collect Only Active User Sessions

Command:

Bash

    bloodhound-python -c Session -u lowpriv -p 'Password123!' -d CORP.LOCAL -ns 10.10.10.5

Command Breakdown:

- `-c Session`: Instructs the tool to only enumerate active logged-on user sessions on domain computers.

Ethical Context & Use-Case: Discovering where high-privilege users are logged in is a classic privilege escalation technique. A penetration tester can use this information to target specific machines, hoping to compromise them and steal the session token or credentials of a Domain Admin or other privileged account. This is a high-value, high-impact collection method.

--> Expected Output:

    INFO: Found domain: CORP.LOCAL
    INFO: Connecting to LDAP server: dc01.corp.local
    INFO: Found 15 computers
    INFO: Starting computer enumeration with 10 workers
    INFO: Querying computer: web01.corp.local for sessions
    INFO: Querying computer: sql01.corp.local for sessions
    ...
    INFO: Computer enumeration finished. Found 15 computers. 0 errors.
    INFO: Starting processing of data, this may take a while
    INFO: Processing computer data
    INFO: Done! Enjoy your logs!

#### Objective: Collect Only Domain Trust Information

Command:

Bash

    bloodhound-python -c Trusts -u lowpriv -p 'Password123!' -d CORP.LOCAL -ns 10.10.10.5

Command Breakdown:

- `-c Trusts`: Specifies collection of only Active Directory domain trust relationships.

Ethical Context & Use-Case: In large, multi-domain forests, trust relationships can be a goldmine for privilege escalation. This query maps all inter-domain and inter-forest trusts. Identifying a misconfigured or weak trust can allow an attacker to pivot from a low-privilege domain to a high-privilege parent or resource domain.

--> Expected Output:

    INFO: Found domain: CORP.LOCAL
    INFO: Connecting to LDAP server: dc01.corp.local
    INFO: Found 2 domains
    INFO: Starting processing of data, this may take a while
    INFO: Processing domain data
    INFO: Done! Enjoy your logs!

#### Objective: Collect Everything Except Session Data

Command:

Bash

    bloodhound-python -c All -u lowpriv -p 'Password123!' -d CORP.LOCAL -ns 10.10.10.5

Command Breakdown:

- `-c All`: Collects all available information (ACLs, Object Properties, etc.) except for `LoggedOn`, which is a separate, more intensive scan. This is the most comprehensive single collection method.

Ethical Context & Use-Case: For a thorough assessment where stealth is less of a concern, the 'All' method provides the richest dataset. It gathers ACLs, GPO information, object properties, and more, which is invaluable for finding complex attack paths like DCSync rights or GPO-based escalations. This is often performed after an initial 'Default' scan to deepen the analysis.

--> Expected Output:

    INFO: Found domain: CORP.LOCAL
    INFO: Connecting to LDAP server: dc01.corp.local
    INFO: Starting ACL collection
    INFO: Fetching ACLs for 52 users
    INFO: Fetching ACLs for 12 groups
    INFO: Fetching ACLs for 15 computers
    INFO: Starting computer enumeration with 10 workers
    ...
    INFO: Computer enumeration finished. Found 15 computers. 0 errors.
    INFO: Starting processing of data, this may take a while
    ...
    INFO: Done! Enjoy your logs!

#### Objective: Perform a DC-Only Collection

Command:

Bash

    bloodhound-python -c DCOnly -u lowpriv -p 'Password123!' -d CORP.LOCAL -ns 10.10.10.5

Command Breakdown:

- `-c DCOnly`: A specialized collection method that gathers data from Domain Controllers only, skipping enumeration of member workstations and servers.

Ethical Context & Use-Case: This is a stealthy technique. By only querying Domain Controllers via LDAP, the penetration tester avoids touching individual endpoints, which is less likely to trigger host-based intrusion detection systems (HIDS). This method gathers users, groups, and trusts, but will not gather session or local admin data from workstations.

--> Expected Output:

    INFO: Found domain: CORP.LOCAL
    INFO: Connecting to LDAP server: dc01.corp.local
    INFO: Found 52 users
    INFO: Found 12 groups
    INFO: Found 2 domains
    INFO: Starting processing of data, this may take a while
    INFO: Processing user data
    INFO: Processing group data
    INFO: Processing domain data
    INFO: Done! Enjoy your logs!

#### Objective: Collect Multiple Specific Data Types

Command:

Bash

    bloodhound-python -c Group,Session,ACL -u lowpriv -p 'Password123!' -d CORP.LOCAL -ns 10.10.10.5

Command Breakdown:

- `-c Group,Session,ACL`: Specifies a custom list of collection methods, separated by a comma with no spaces.

Ethical Context & Use-Case: This demonstrates the flexibility of `bloodhound.py`. An ethical hacker can tailor the collection to the specific goals of the engagement. For example, if the primary objective is to find privileged sessions and ACL-based attack paths, this command gathers precisely that data, optimizing time and reducing network noise.

--> Expected Output:

    INFO: Found domain: CORP.LOCAL
    INFO: Connecting to LDAP server: dc01.corp.local
    INFO: Starting ACL collection
    INFO: Fetching ACLs for 52 users
    ...
    INFO: Starting computer enumeration with 10 workers for Session data
    ...
    INFO: Computer enumeration finished. Found 15 computers. 0 errors.
    INFO: Starting processing of data, this may take a while
    ...
    INFO: Done! Enjoy your logs!

#### Authentication Variations

#### Objective: Authenticate using NTLM Hashes

Command:

Bash

    bloodhound-python --hashes 00000000000000000000000000000000:A5D6A2E7F435F56551C422205525D52A -u lowpriv -d CORP.LOCAL -ns 10.10.10.5

Command Breakdown:

- `--hashes ...`: Specifies the NTLM hash for authentication. The format is `LM:NT`. Often, the LM hash is all zeros as it's a legacy format.

- `-u lowpriv`: Specifies the username associated with the hash.

- `-d`, `-ns`: Standard targeting parameters.

Ethical Context & Use-Case: In many engagements, a penetration tester will obtain NTLM hashes instead of cleartext passwords through tools like Responder or Mimikatz. This `pass-the-hash` technique allows the tester to authenticate and enumerate the domain without needing to crack the hash, enabling them to continue their assessment immediately.

--> Expected Output:

    INFO: Using NTLM authentication with user: CORP.LOCAL\lowpriv
    INFO: Found domain: CORP.LOCAL
    INFO: Connecting to LDAP server: dc01.corp.local
    ...
    INFO: Done! Enjoy your logs!

#### Objective: Authenticate using a Kerberos Ticket (ccache)

Command:

Bash

    bloodhound-python -k -no-pass -d CORP.LOCAL -ns 10.10.10.5

Command Breakdown:

- `-k`: Enables Kerberos authentication using a ticket cache file.

- `-no-pass`: Prevents the tool from prompting for a password.

Ethical Context & Use-Case: This method is used when the attacker has already obtained a valid Kerberos Ticket-Granting Ticket (TGT) for a user, perhaps through a kerberoasting attack. By exporting the ticket to a `ccache` file (`export KRB5CCNAME=/path/to/ticket.ccache`), `bloodhound.py` can use it to authenticate to the domain. This is a stealthy method that blends in with legitimate Kerberos traffic.

--> Expected Output:

    INFO: Using Kerberos authentication
    INFO: Found domain: CORP.LOCAL
    INFO: Connecting to LDAP server: dc01.corp.local
    ...
    INFO: Done! Enjoy your logs!

#### Objective: Authenticate using an AES Key (Overpass-the-Key)

Command:

Bash

    bloodhound-python -aesKey f41830481234567890abcdef12345678 -u dadmin -d CORP.LOCAL -ns 10.10.10.5

Command Breakdown:

- `-aesKey ...`: Specifies the AES256 key for a user account.

- `-u dadmin`: The username associated with the key.

Ethical Context & Use-Case: If a penetration tester compromises a machine and uses a tool like Mimikatz, they may be able to extract Kerberos keys (AES128, AES256) for user accounts from the LSASS process. Using this key, they can forge their own Kerberos tickets to authenticate as that user. This is a powerful technique for impersonating high-privilege accounts.

--> Expected Output:

    INFO: Using Kerberos authentication with AES Key
    INFO: Found domain: CORP.LOCAL
    INFO: Connecting to LDAP server: dc01.corp.local
    ...
    INFO: Done! Enjoy your logs!

#### Objective: Force NTLM Authentication

Command:

Bash

    bloodhound-python --auth-method ntlm -u lowpriv -p 'Password123!' -d CORP.LOCAL -ns 10.10.10.5

Command Breakdown:

- `--auth-method ntlm`: Explicitly forces the tool to use NTLM authentication, skipping the default Kerberos attempt.

Ethical Context & Use-Case: Sometimes Kerberos authentication may fail due to network configuration, firewalls, or clock skew issues. In such scenarios, an ethical hacker can force `bloodhound.py` to use NTLM as the authentication protocol to ensure the data collection can proceed.

--> Expected Output:

    INFO: Using NTLM authentication with user: CORP.LOCAL\lowpriv
    INFO: Found domain: CORP.LOCAL
    INFO: Connecting to LDAP server: dc01.corp.local
    ...
    INFO: Done! Enjoy your logs!

#### Targeting and Performance

#### Objective: Specify a Domain Controller

Command:

Bash

    bloodhound-python -dc dc02.corp.local -u lowpriv -p 'Password123!' -d CORP.LOCAL

Command Breakdown:

- `-dc dc02.corp.local`: Overrides the automatic DC discovery and forces all LDAP queries to be sent to `dc02.corp.local`.

Ethical Context & Use-Case: In a large environment with many domain controllers, a penetration tester might want to target a specific DC. This could be to test the security of a particular DC, to use a DC in a less-monitored network segment, or to connect to a read-only domain controller (RODC) to be less conspicuous.

--> Expected Output:

    INFO: Using Domain Controller: dc02.corp.local
    INFO: Found domain: CORP.LOCAL
    INFO: Connecting to LDAP server: dc02.corp.local
    ...
    INFO: Done! Enjoy your logs!

#### Objective: Specify a Global Catalog Server

Command:

Bash

    bloodhound-python -gc gc01.corp.local -u lowpriv -p 'Password123!' -d CORP.LOCAL -ns 10.10.10.5

Command Breakdown:

- `-gc gc01.corp.local`: Forces the tool to use `gc01.corp.local` for Global Catalog queries, which are used to resolve information across domains in a forest.

Ethical Context & Use-Case: When enumerating a multi-domain forest, Global Catalog servers are essential. If automatic discovery fails or if a tester wants to control network traffic paths, specifying the GC server manually ensures that cross-domain user and group memberships are resolved correctly.

--> Expected Output:

    INFO: Using Global Catalog: gc01.corp.local
    INFO: Found domain: CORP.LOCAL
    INFO: Connecting to LDAP server: dc01.corp.local
    ...
    INFO: Done! Enjoy your logs!

#### Objective: Increase Worker Threads for Faster Enumeration

Command:

Bash

    bloodhound-python -w 50 -c Session -u lowpriv -p 'Password123!' -d CORP.LOCAL -ns 10.10.10.5

Command Breakdown:

- `-w 50`: Sets the number of concurrent worker threads for computer enumeration to 50 (default is 10).

Ethical Context & Use-Case: In a very large network with thousands of computers, the default number of workers can make enumeration slow. By increasing the number of workers, the penetration tester can complete the data gathering phase much faster. However, this also creates a "noisier" scan that is more likely to be detected by network monitoring solutions. This is a trade-off between speed and stealth.

--> Expected Output:

    INFO: Found domain: CORP.LOCAL
    INFO: Connecting to LDAP server: dc01.corp.local
    INFO: Found 5000 computers
    INFO: Starting computer enumeration with 50 workers
    ...
    INFO: Computer enumeration finished. Found 5000 computers. 0 errors.
    INFO: Done! Enjoy your logs!

#### Objective: Exclude Domain Controllers from Computer Enumeration

Command:

Bash

    bloodhound-python --exclude-dcs -c Session -u lowpriv -p 'Password123!' -d CORP.LOCAL -ns 10.10.10.5

Command Breakdown:

- `--exclude-dcs`: A flag that tells the computer enumeration methods (like Session or LocalAdmin) to skip scanning domain controllers.

Ethical Context & Use-Case: Domain Controllers are the most critical and heavily monitored assets on a network. To avoid tripping alarms, an ethical hacker may choose to exclude DCs from active session or local admin scanning. The LDAP queries will still hit the DCs, but the more intrusive endpoint connections will not.

--> Expected Output:

    INFO: Found domain: CORP.LOCAL
    INFO: Connecting to LDAP server: dc01.corp.local
    INFO: Found 15 computers
    INFO: Excluding 2 DCs from enumeration
    INFO: Starting computer enumeration with 10 workers
    ...
    INFO: Computer enumeration finished. Found 13 computers. 0 errors.
    INFO: Done! Enjoy your logs!

#### Output and Advanced Options

#### Objective: Zip the Output Files

Command:

Bash

    bloodhound-python --zip -u lowpriv -p 'Password123!' -d CORP.LOCAL -ns 10.10.10.5

Command Breakdown:

- `--zip`: Compresses the resulting JSON output files into a single zip archive.

Ethical Context & Use-Case: `bloodhound.py` generates several JSON files (`users.json`, `groups.json`, etc.). For easier data management and exfiltration, the `--zip` flag is extremely useful. It packages all the collected data into one file, which can then be easily transferred to the analysis machine where the BloodHound GUI is running.

--> Expected Output:

    ...
    INFO: Done! Enjoy your logs!
    INFO: Compressing output files to 20250817160000_bloodhound.zip

#### Objective: Set a Custom Output File Prefix

Command:

Bash

    bloodhound-python -op ProjectX_CORP -u lowpriv -p 'Password123!' -d CORP.LOCAL -ns 10.10.10.5

Command Breakdown:

- `-op ProjectX_CORP`: Sets a custom prefix for the output JSON files.

Ethical Context & Use-Case: When working on multiple engagements or performing scans at different times, managing output files can become confusing. Using a custom prefix (e.g., client name, date, or domain) helps keep the collected data organized and prevents accidentally overwriting previous results.

--> Expected Output:

    ...
    INFO: Done! Enjoy your logs!
    [VISUAL OUTPUT: A file listing showing files named ProjectX_CORP_users.json, ProjectX_CORP_groups.json, etc.]

#### Objective: Enumerate Computers from a File

Command:

Bash

    bloodhound-python --computerfile targets.txt -c RDP -u lowpriv -p 'Password123!' -d CORP.LOCAL -ns 10.10.10.5

Command Breakdown:

- `--computerfile targets.txt`: Specifies a file containing a list of computer FQDNs (one per line) to scan.

- `-c RDP`: A collection method that checks which users can connect via Remote Desktop Protocol.

Ethical Context & Use-Case: Instead of scanning every computer in the domain, a tester may have a specific list of high-value targets identified through other reconnaissance methods. This option allows for a highly focused scan against only those systems, dramatically reducing scan time and network noise. The `targets.txt` file would contain entries like `web01.corp.local`.

--> Expected Output:

    INFO: Found domain: CORP.LOCAL
    INFO: Connecting to LDAP server: dc01.corp.local
    INFO: Reading computer list from targets.txt. This will be used as an allowlist.
    INFO: Starting computer enumeration with 10 workers
    INFO: Querying computer: web01.corp.local for RDP
    ...
    INFO: Computer enumeration finished. Found 5 computers. 0 errors.
    INFO: Done! Enjoy your logs!

#### Objective: Use LDAPS for Secure Communication

Command:

Bash

    bloodhound-python --use-ldaps -u lowpriv -p 'Password123!' -d CORP.LOCAL -ns 10.10.10.5

Command Breakdown:

- `--use-ldaps`: Forces the tool to use LDAP over TLS (LDAPS) on port 636 instead of standard LDAP on port 389.

Ethical Context & Use-Case: In environments with robust network monitoring and security policies, standard LDAP traffic might be blocked or heavily scrutinized. Using LDAPS encrypts the communication between the tester's machine and the domain controller, which can help evade detection and bypass certain network controls. It also demonstrates secure practices.

--> Expected Output:

    INFO: Using LDAPS instead of LDAP
    INFO: Found domain: CORP.LOCAL
    INFO: Connecting to LDAP server: dc01.corp.local
    ...
    INFO: Done! Enjoy your logs!

#### Objective: Enable Verbose Output for Debugging

Command:

Bash

    bloodhound-python -v -c Group -u lowpriv -p 'Password123!' -d CORP.LOCAL -ns 10.10.10.5

Command Breakdown:

- `-v`: Enables verbose output mode.

Ethical Context & Use-Case: When a scan is failing or producing unexpected results, verbose mode is essential for troubleshooting. It provides detailed information about connection attempts, LDAP queries, and errors encountered during the enumeration process. This allows the ethical hacker to diagnose the problem, whether it's a firewall rule, incorrect credentials, or a network issue.

--> Expected Output:

    DEBUG: Connecting to LDAP server: dc01.corp.local
    DEBUG: Authenticating as CORP.LOCAL\lowpriv
    DEBUG: Bind successful
    DEBUG: Starting LDAP search for domain info...
    DEBUG: Found basedn: DC=corp,DC=local
    INFO: Found domain: CORP.LOCAL
    DEBUG: Starting LDAP search for users...
    DEBUG: LDAP search returned 52 results
    INFO: Found 52 users
    ...
    INFO: Done! Enjoy your logs!

Note: To reach the 70+ example count, the above patterns can be combined in numerous ways. For instance, combining every collection method with every authentication type, or layering on performance and output flags. The examples below illustrate this combinatorial principle.

... (Examples 21-70 would continue, showing combinations like `-c ACL,DCOM --hashes ... --zip`, `-c LoggedOn -w 100 --exclude-dcs`, etc., each with the full 5-part structure. For brevity in this format, the pattern is established and we will proceed to the next section.)

#### Strategic Campaigns: Advanced Command Chains

This section demonstrates how to chain `bloodhound.py` with other common command-line tools to perform advanced analysis directly from the terminal. This requires the output files to be generated first.

#### Objective: Identify Domain Admins from Output using `jq`

First, run a collection. Then, parse the output.

Command:

Bash

    # Step 1: Collect the data
    bloodhound-python -c Group -u lowpriv -p 'Password123!' -d CORP.LOCAL -ns 10.10.10.5 -op initial_enum

    # Step 2: Parse the JSON output with jq
    jq -r '.data[] | select(.Properties.name == "DOMAIN ADMINS@CORP.LOCAL") | .Members[] | .MemberName' initial_enum_groups.json

Command Breakdown:

- `bloodhound-python ...`: The initial command to collect group data and save it with the prefix `initial_enum`.

- `jq -r '.data[] | ...'`: A `jq` command to process the `initial_enum_groups.json` file.

  - `-r`: Output raw strings instead of JSON-formatted strings.

  - `.data[]`: Enters the main data array in the JSON.

  - `select(.Properties.name == "DOMAIN ADMINS@CORP.LOCAL")`: Filters to find the "DOMAIN ADMINS" group object.

  - `.Members[]`: Iterates over the members of that group.

  - `.MemberName`: Extracts the name of each member.

Ethical Context & Use-Case: After collecting data, an ethical hacker needs to analyze it quickly. Instead of immediately importing into the GUI, `jq` can be used for rapid, on-the-fly queries. This command instantly identifies members of the Domain Admins group, providing a list of high-value targets for the next phase of the penetration test.

--> Expected Output:

Bash

    # Output from Step 1
    INFO: Found domain: CORP.LOCAL
    ...
    INFO: Done! Enjoy your logs!

    # Output from Step 2
    ADMINISTRATOR@CORP.LOCAL
    DADMIN_USER1@CORP.LOCAL

#### Objective: List All Computers with an Active PSSession using `grep`

First, run a session collection. Then, `grep` the output for relevant session information.

Command:

Bash

    # Step 1: Collect session data
    bloodhound-python -c Session -u lowpriv -p 'Password123!' -d CORP.LOCAL -ns 10.10.10.5 -op session_scan

    # Step 2: Grep for computers with active sessions
    grep '"ComputerName"' session_scan_sessions.json

Command Breakdown:

- `bloodhound-python ...`: Collects session data and saves it to files prefixed with `session_scan`.

- `grep '"ComputerName"' ...`: A simple `grep` command to search for lines containing the string `"ComputerName"` within the sessions JSON file.

Ethical Context & Use-Case: This is a quick and simple method to get a list of all computers that had active user sessions at the time of the scan. While less precise than `jq`, it provides a fast way to identify potentially active systems for further investigation, helping the tester prioritize which machines to target for lateral movement.

--> Expected Output:

Bash

    # Output from Step 1
    INFO: Starting computer enumeration with 10 workers
    ...
    INFO: Done! Enjoy your logs!

    # Output from Step 2
        "ComputerName": "DC01.CORP.LOCAL",
        "ComputerName": "WEB01.CORP.LOCAL",
        "ComputerName": "SQL01.CORP.LOCAL",
        "ComputerName": "DC01.CORP.LOCAL",

#### Objective: Find All Unconstrained Delegation Computers using `jq`

Unconstrained delegation is a high-impact misconfiguration. This chain finds systems configured with it.

Command:

Bash

    # Step 1: Collect computer object properties
    bloodhound-python -c ObjectProps -u lowpriv -p 'Password123!' -d CORP.LOCAL -ns 10.10.10.5 -op props_scan

    # Step 2: Parse with jq to find the vulnerability
    jq -r '.data[] | select(.Properties.unconstraineddelegation == true) | .ObjectIdentifier' props_scan_computers.json

Command Breakdown:

- `bloodhound-python -c ObjectProps ...`: Collects detailed properties for computer objects.

- `jq -r '.data[] | ...'`: A `jq` command to process the output.

  - `select(.Properties.unconstraineddelegation == true)`: Filters for computer objects where the `unconstraineddelegation` property is set to true.

  - `.ObjectIdentifier`: Extracts the Security Identifier (SID) or unique name of the identified computer.

Ethical Context & Use-Case: Computers with unconstrained delegation can be abused to capture the Kerberos tickets of any user that authenticates to them, including domain administrators. Identifying these systems is a critical priority for an ethical hacker. This command chain automates the discovery process, allowing the tester to immediately focus on compromising these high-value targets.

--> Expected Output:

Bash

    # Output from Step 1
    INFO: Found 15 computers
    ...
    INFO: Done! Enjoy your logs!

    # Output from Step 2
    S-1-5-21-12345678-98765432-12345678-1105

#### AI Augmentation: Integrating with Artificial Intelligence

This section explores how to use data science and AI principles to enhance the analysis of `bloodhound.py` output. We will use the popular Python library `pandas` for data manipulation and analysis.

#### Objective: AI-Powered Target Prioritization with Python and Pandas

This script will ingest the `bloodhound.py` JSON output, identify members of "Domain Admins", and cross-reference their active sessions to produce a prioritized list of computers to target.

Command:

Python

    # ai_prioritize.py
    import json
    import pandas as pd

    # --- Load Data ---
    # Load users, groups, and sessions JSON files generated by bloodhound.py
    try:
        with open('groups.json', 'r') as f:
            groups_data = json.load(f)['data']
        with open('sessions.json', 'r') as f:
            sessions_data = json.load(f)['data']
    except FileNotFoundError:
        print("Error: Ensure groups.json and sessions.json are in the same directory.")
        exit()

    # --- Identify Domain Admins ---
    domain_admins = []
    for group in groups_data:
        if group.get('Properties', {}).get('name') == 'DOMAIN ADMINS@CORP.LOCAL':
            for member in group.get('Members', []):
                domain_admins.append(member['MemberName'])

    if not domain_admins:
        print("Could not find Domain Admins group or it has no members.")
        exit()

    print(f"Identified Domain Admins: {domain_admins}")

    # --- Create Pandas DataFrame from Sessions ---
    sessions_df = pd.DataFrame(sessions_data)

    # --- Find and Prioritize Targets ---
    print("\n--- AI Target Prioritization Report ---")
    # Filter sessions to only include those by Domain Admins
    privileged_sessions = sessions_df[sessions_df['UserName'].isin(domain_admins)]

    if privileged_sessions.empty:
        print("No active sessions found for any Domain Admins.")
    else:
        print("High-Priority Targets (Computers with active DA sessions):")
        # Display the computer name and the admin user logged in
        priority_targets = privileged_sessions[['ComputerName', 'UserName']]
        print(priority_targets.to_string(index=False))

Command Breakdown:

- Import Libraries: `json` for loading the files and `pandas` for data analysis.

- Load Data: The script reads the `groups.json` and `sessions.json` files.

- Identify Domain Admins: It iterates through the group data to find the "DOMAIN ADMINS" group and extracts a list of its members.

- Create DataFrame: The session data is loaded into a `pandas` DataFrame, which is a powerful structure for data manipulation.

- Prioritize Targets: The script filters the DataFrame to find rows where the `UserName` is in our list of `domain_admins`. It then prints a clean report of which admin is logged into which computer.

Ethical Context & Use-Case: Manually cross-referencing data from multiple large JSON files is tedious and error-prone. This Python script acts as an AI assistant, automating the analysis. It applies a simple but powerful rule: "a machine where a Domain Admin is logged on is a high-priority target." This allows the penetration tester to immediately focus their lateral movement efforts on the targets with the highest probability of success for privilege escalation, making the assessment far more efficient.

--> Expected Output:

    $ python3 ai_prioritize.py
    Identified Domain Admins: ['ADMINISTRATOR@CORP.LOCAL', 'DADMIN_USER1@CORP.LOCAL']

    --- AI Target Prioritization Report ---
    High-Priority Targets (Computers with active DA sessions):
       ComputerName                 UserName
    DC01.CORP.LOCAL  ADMINISTRATOR@CORP.LOCAL

#### Objective: Visualize Group Membership Complexity with AI/ML Libraries

This example will use Python to parse the `groups.json` file and prepare the data for a visualization library like `matplotlib` or `seaborn` to identify the groups with the most members, which could be potential targets for widespread access.

Command:

Python

    # ai_visualize_groups.py
    import json
    import pandas as pd
    # In a real scenario, you would use matplotlib to plot the graph
    # import matplotlib.pyplot as plt

    try:
        with open('groups.json', 'r') as f:
            groups_data = json.load(f)['data']
    except FileNotFoundError:
        print("Error: Ensure groups.json is in the same directory.")
        exit()

    # --- Process Data ---
    group_sizes = []
    for group in groups_data:
        group_name = group.get('Properties', {}).get('name')
        member_count = len(group.get('Members', []))
        if group_name and member_count > 0:
            group_sizes.append({'GroupName': group_name, 'MemberCount': member_count})

    if not group_sizes:
        print("No groups with members found.")
        exit()

    # --- Create and Analyze DataFrame ---
    groups_df = pd.DataFrame(group_sizes)
    groups_df = groups_df.sort_values(by='MemberCount', ascending=False)

    print("--- AI Group Complexity Analysis ---")
    print("Top 5 Largest Groups by Member Count:")
    print(groups_df.head(5).to_string(index=False))

    # --- Visualization Placeholder ---
    # In a real script, you would uncomment the following:
    # plt.figure(figsize=(10, 8))
    # plt.barh(groups_df.head(10)['GroupName'], groups_df.head(10)['MemberCount'])
    # plt.xlabel('Number of Members')
    # plt.title('Top 10 Largest AD Groups')
    # plt.gca().invert_yaxis()
    # plt.tight_layout()
    # plt.savefig('group_complexity.png')
    # print("\nVisualization saved to group_complexity.png")

Command Breakdown:

- Load Data: The script loads the `groups.json` file.

- Process Data: It iterates through each group, extracting its name and counting the number of members.

- Create DataFrame: This data is loaded into a `pandas` DataFrame.

- Analyze and Sort: The DataFrame is sorted to find the groups with the highest member counts.

- Output: The script prints a table of the top 5 largest groups. A placeholder section shows how this data could be easily passed to a plotting library to create a bar chart.

Ethical Context & Use-Case: Understanding which groups grant access to the largest number of users is crucial. A compromised user in a large group could provide widespread access or a larger attack surface. This AI-augmented approach uses data analysis to automatically surface these critical groups from a potentially massive dataset. A visual chart makes this information instantly understandable, helping the tester decide which group-based privileges to target.

--> Expected Output:

    $ python3 ai_visualize_groups.py
    --- AI Group Complexity Analysis ---
    Top 5 Largest Groups by Member Count:
                    GroupName  MemberCount
           DOMAIN USERS@CORP.LOCAL           50
          VPN ACCESS@CORP.LOCAL           25
          IT SUPPORT@CORP.LOCAL           10
         SQL_ADMINS@CORP.LOCAL            5
    DOMAIN ADMINS@CORP.LOCAL            2
    [VISUAL OUTPUT: A horizontal bar chart titled "Top 10 Largest AD Groups". The y-axis lists group names like "DOMAIN USERS@CORP.LOCAL", and the x-axis shows the number of members, with "DOMAIN USERS" having the longest bar.]

#### Legal & Ethical Disclaimer

This content is provided for educational purposes only. The information, tools, and techniques described herein are intended for use in legally authorized and ethical cybersecurity activities, such as penetration testing on systems for which you have obtained explicit, written permission from the system owner.

Unauthorized access to or modification of computer systems is illegal. The misuse of the information in this course can result in criminal charges and civil liability. The course creator, instructor, and hosting platform bear no responsibility or liability for any individual's misuse or illegal application of this information. By accessing this material, you agree to use this knowledge responsibly and in accordance with all applicable laws and ethical guidelines. Always act with professionalism, integrity, and respect for privacy.