> ## Documentation Index
> Fetch the complete documentation index at: https://0-x.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# BloodHound

[BloodHound](https://bloodhound.specterops.io/get-started/introduction) collects the same kind of data [AD Enumeration (Credentialed)](https://0-x.dev/ad/enumeration-credentialed.md) does manually, users, groups, computers, sessions, ACLs, GPOs, trusts, and loads it into a graph database  instead of a flat list. Every object becomes a node, every relationship (group membership, admin rights, session presence, a dangerous ACL) becomes very clear. The payoff: instead of manually chaining "this user is in that group, which has this privileges over this computer, where that other user has ..." by hand, BloodHound's graph queries compute the shortest actual attack path to Domain Admin for you. It's a very powerful tool.

***

## Collecting Data

### Linux (bloodhound-python)

```bash theme={null}
sudo bloodhound-python -u '<user>' -p '<pass>' -ns <dc-ip> -d <domain-name> -c all
```

### Windows (SharpHound)

```powershell theme={null}
.\SharpHound.exe -c All --zipfilename <zip-name>
```

```powershell theme={null}
Import-Module .\SharpHound.ps1
Invoke-Bloodhound -CollectionMethod All
```

### NetExec

```bash theme={null}
netexec ldap <dc-ip> -u '<user>' -p '<pass>' --bloodhound -c All
```

> [!TIP]
>
> `-c All` / `-CollectionMethod All` pulls every collection method at once (sessions, ACLs, group membership, trusts, etc.), the most thorough option but also the noisiest.

***

## Running BloodHound

```bash theme={null}
# Start the Neo4j graph database service
sudo neo4j start

# Launch BloodHound itself
bloodhound
```

Import the zip/JSON output from the collection step above through the GUI, then query the graph.

***

## Querying with Cypher

BloodHound's GUI covers the common pre-built queries (shortest path to Domain Admin, Kerberoastable users, etc.), but custom Cypher queries reach things the defaults don't. Here you can find a huge list with [Custom Queries for Bloodhound](https://github.com/hausec/Bloodhound-Custom-Queries). Two examples:

```cypher theme={null}
// Find users with WinRM rights to a computer
MATCH p1=shortestPath((u1:User)-[r1:MemberOf*1..]->(g1:Group))
MATCH p2=(u1)-[:CanPSRemote*1..]->(c:Computer)
RETURN p2
```

```cypher theme={null}
// Find users with SQL Server Admin rights on a computer
MATCH p1=shortestPath((u1:User)-[r1:MemberOf*1..]->(g1:Group))
MATCH p2=(u1)-[:SQLAdmin*1..]->(c:Computer)
RETURN p2
```

***

## Quick Reference Tools

> **[AD Enumeration (Credentialed)](https://0-x.dev/ad/enumeration-credentialed.md)**
>
> The manual equivalent of what BloodHound automates and graphs.

> **[BloodHound Docs](https://bloodhound.specterops.io/get-started/introduction)**
>
> Official getting-started documentation.

> **[BloodHound Custom Queries](https://github.com/hausec/Bloodhound-Custom-Queries)**
>
> A ready-made library of custom Cypher queries for the GUI.

> **[BloodHound Cypher Cheat Sheet](https://hausec.com/2019/09/09/bloodhound-cypher-cheatsheet/)**
>
> Reference for writing custom queries beyond the two examples above.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.