skills.rest
Yenn503
Yenn503COMMUNITY
Explore all skills by this author →
WebsiteGitHub

exploiting-active-directory-with-bloodhound

Maps Active Directory attack paths using BloodHound graph analysis and SharpHound data collection.

1|1|Updated Apr 3, 2026
Search Tags:#red-team#active-directory#privilege-escalation#kerberoasting#bloodhound#attack-path#sharphound
One-click install
npx skills add https://github.com/Yenn503/Net-Runners --skill exploiting-active-directory-with-bloodhound-yenn503
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: exploiting-active-directory-with-bloodhound
Source: https://github.com/Yenn503/Net-Runners/tree/main/.netrunner/skills/infra/exploiting-active-directory-with-bloodhound
Command: npx skills add https://github.com/Yenn503/Net-Runners --skill exploiting-active-directory-with-bloodhound-yenn503

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Manually tracing privilege escalation paths in large Active Directory environments is slow and error-prone, making it hard for authorized red teams to find hidden relationships between compromised accounts and high-value targets like Domain Admins. ## Core Features & Use Cases - Graph-Based AD Reconnaissance: Collect AD objects, ACLs, sessions, and group memberships with SharpHound or BloodHound.py and visualize them in BloodHound CE. - Attack Path Analysis: Run built-in queries for shortest path to Domain Admins, Kerberoastable and AS-REP roastable accounts, DCSync rights, and ACL-based escalation (GenericAll, WriteDACL, ForceChangePassword). - Use Case: During an authorized red team engagement, an operator compromises a standard user account, runs SharpHound collection, imports the data into BloodHound, and identifies a three-step ACL abuse chain leading to Domain Admin, documenting each step as evidence. ## Quick Start Ask the agent to collect Active Directory data with SharpHound and identify the shortest attack path from the compromised account to Domain Admins.

Frequently Asked Questions about exploiting-active-directory-with-bloodhound

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find attack paths to Domain Admin with BloodHound?▼

Collect AD data with SharpHound or BloodHound.py, import it into BloodHound CE, mark compromised accounts as owned, and run the Shortest Path to Domain Admins query. The graph reveals ACL abuse, group membership, and delegation chains leading to DA.

What is the difference between SharpHound and BloodHound.py?▼

SharpHound is the official .NET collector running on Windows hosts, while BloodHound.py is a Python-based collector that runs from Linux or Windows. Both gather AD objects, sessions, ACLs, and group memberships into ZIP files for BloodHound import.

Can BloodHound detect Kerberoastable and AS-REP roastable accounts?▼

Yes, BloodHound includes pre-built queries for Kerberoastable users with paths to DA and AS-REP roastable accounts without pre-authentication. These queries run against imported SharpHound data in the Neo4j graph.

Which SharpHound collection method should I use?▼

Use the All method for comprehensive collection, DCOnly for minimal footprint against domain controllers, or Session and LoggedOn for targeted session data. Multi-domain environments require collection from every reachable domain.

Is BloodHound legal to use against production Active Directory?▼

BloodHound is legal only with explicit written authorization from the system owner, such as during contracted penetration tests or red team exercises. Unauthorized use against systems you do not own violates computer fraud laws.

Related Skills

Explore More Software Engineering Skills→
wgpsecwgpsec
1.6k

internal-recon

Map live hosts, open ports, services, and critical assets in internal networks using fscan.

Official
Intermediate
braydos-hbraydos-h
4

conducting-internal-reconnaissance-with-bloodhound-ce

Maps Active Directory attack paths using BloodHound CE graph analysis and Cypher queries.

Community
Advanced
xalgordxalgord
954

performing-active-directory-penetration-test

Conducts Active Directory penetration tests covering enumeration, Kerberos attacks, ADCS exploitation, and domain compromise.

Community
Advanced
brucesongsbrucesongs
60

ad-ldap-attack

Enumerate Active Directory LDAP environments to reveal users, groups, SPNs, and credential artifacts.

Community
Advanced