skills.rest
braydos-h
braydos-hCOMMUNITY
Explore all skills by this author →
GitHub

conducting-internal-reconnaissance-with-bloodhound-ce

Maps Active Directory attack paths using BloodHound CE graph analysis and Cypher queries.

4|Updated Apr 28, 2026
Search Tags:#reconnaissance#red-team#active-directory#privilege-escalation#cypher#attack-paths#bloodhound
One-click install
npx skills add https://github.com/braydos-h/BreachPilot --skill conducting-internal-reconnaissance-with-bloodhound-ce-braydos-h
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: conducting-internal-reconnaissance-with-bloodhound-ce
Source: https://github.com/braydos-h/BreachPilot/tree/main/skills/conducting-internal-reconnaissance-with-bloodhound-ce
Command: npx skills add https://github.com/braydos-h/BreachPilot --skill conducting-internal-reconnaissance-with-bloodhound-ce-braydos-h

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires neo4j, bloodhound, and includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve? During authorized penetration tests, manually enumerating Active Directory relationships to find privilege escalation routes is slow and error-prone. This Skill automates internal AD reconnaissance with BloodHound CE, revealing hidden attack paths from compromised accounts to high-value targets like Domain Admins. ## Core Features & Use Cases - BloodHound CE Deployment & Collection: Deploy the BloodHound CE stack via Docker Compose and collect AD data with SharpHound v2 or bloodhound-python. - Graph-Based Attack Path Analysis: Run built-in and custom Cypher queries to find shortest paths to Domain Admin, Kerberoastable and AS-REP roastable accounts, DCSync rights, and delegation abuse. - Automated Reporting: Analyze exported BloodHound JSON data and generate prioritized attack path reports with the included Python scripts and report template. - Use Case: After obtaining initial domain credentials in a sanctioned assessment, collect directory data, import it into BloodHound CE, mark owned principals, and produce a documented list of feasible privilege escalation chains for the engagement report. ## Quick Start Ask the agent to collect Active Directory data with bloodhound-python for your authorized domain and run the BloodHound CE reconnaissance queries against your Neo4j instance to identify attack paths to Domain Admins.

Frequently Asked Questions about conducting-internal-reconnaissance-with-bloodhound-ce

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I collect Active Directory data for BloodHound CE?▼

Use SharpHound v2 on a Windows host with commands like SharpHound.exe -c All, or run bloodhound-python from Linux with the domain, credentials, and domain controller IP. Both produce ZIP files you import through the BloodHound CE web interface.

How do I find the shortest attack path to Domain Admin in BloodHound?▼

Run a Cypher shortestPath query matching owned principals to the Domain Admins group, such as MATCH p=shortestPath((n {owned:true})-[*1..]->(m:Group)). The included agent.py script automates this query against Neo4j and lists users by hop count.

What is the difference between SharpHound and bloodhound-python?▼

SharpHound is a .NET collector run on compromised Windows hosts and supports stealthy DCOnly and session loop modes. Bloodhound-python runs from Linux using provided credentials and supports collection methods like all, group, session, trusts, and acl.

Does BloodHound CE work with Azure AD or Entra ID environments?▼

Yes, AzureHound is the dedicated collector for Azure AD and Entra ID environments, gathering data that imports into BloodHound CE for the same graph-based attack path analysis used on-premises.

Why does bloodhound-python collection fail or time out?▼

Collection fails when the domain controller IP is unreachable, credentials are invalid, or LDAP ports are blocked. The agent script returns a timeout status after 300 seconds and reports a missing installation error if the bloodhound package is not installed.

Is BloodHound reconnaissance legal to run against a domain?▼

Only with explicit written authorization for the target environment. This Skill is intended for sanctioned penetration tests and lab use, and unauthorized use against systems you do not own may violate computer fraud laws.

Related Skills

Explore More Software Engineering Skills→
hardw00thardw00t
90

network-pentest

Simulate attacker techniques across internal networks and Active Directory environments.

Community
Advanced
Prohao42Prohao42
120

active-directory-kerberos-attacks

Exploit Kerberos vulnerabilities in Active Directory for reconnaissance and privilege escalation.

Community
Advanced
webrix-aiwebrix-ai
1

vulnerability-prioritization

Correlate CVE scan results with infrastructure to prioritize patching and create Jira tickets.

Official
Advanced
brucesongsbrucesongs
60

ad-ldap-attack

Enumerate Active Directory LDAP environments to reveal users, groups, SPNs, and credential artifacts.

Community
Advanced