Tagged: BloodHound
9 posts · browse all tags
-
Old Kit, New Kit Part 11: AD Enumeration, BloodHound and Certipy vs ldapsearch and net
Enumerating a fresh Active Directory domain two ways — ldapsearch and net rpc against bloodhound-python and certipy-ad — including a full ESC1 certificate exploit, and checking what each one actually leaves in Wazuh.
-
BloodHound Deep Dive Part 1: History, Community Edition, and Where It Sits in an Engagement
Where BloodHound came from, how Community Edition is actually built (Postgres, Neo4j, a single Go binary), and where attack-path analysis fits between recon and exploitation in a real engagement.
-
BloodHound Deep Dive Part 2: SharpHound and What It Actually Collects
SharpHound's real collection methods, the Stealth flag's documented behavior, and what a DCOnly run against CONTOSO.LOCAL would and wouldn't surface, taken from SpecterOps' own flag reference rather than guessed.
-
BloodHound Deep Dive Part 3: Ingestion, Postgres, Neo4j, and the Go API
How a SharpHound JSON upload becomes graph data, what Postgres versus Neo4j is actually responsible for, and standing up a real Neo4j instance in a sandbox with no Docker and no root to verify the graph layer directly.
-
BloodHound Deep Dive Part 4: Cypher and the Built-In Attack Path Queries
Running BloodHound's canned attack-path query patterns as real Cypher against the seeded CONTOSO.LOCAL graph, including a shortestPath query that comes back empty and what that empty result actually means.
-
BloodHound Deep Dive Part 5: Kerberoasting and AS-REP Roasting Through the Graph
BloodHound's real hasspn and dontreqpreauth properties point at the exact same two accounts Impacket Deep Dive found by hand, and a clean shortestPath query with no results shows why being roastable isn't the same as being worth roasting.
-
BloodHound Deep Dive Part 6: From GenericAll to a Working Credential
Turning the GenericAll to ForceChangePassword chain from Part 4 into an actual credential with bloodyAD, the real cross-platform ACL abuse tool that pairs with Impacket's own SOCKS-proxy-friendly design.
-
BloodHound Deep Dive Part 7: Detecting SharpHound and LDAP-Based ACL Abuse
What SharpHound's own documented collection behavior leaves in the event log, why 4662 volume is the tell, and the defensive case for running BloodHound against your own domain before an attacker's copy does.
-
BloodHound Deep Dive Part 8: A Full Walkthrough, From Foothold to a Graph-Confirmed Credential
Tying all seven parts together against CONTOSO.LOCAL: collection, ingestion, querying, and ACL abuse in order, and what it means that the graph runs out of edges before Domain Admins.