conducting-internal-reconnaissance-with-bloodhound-ce

mukul975/Anthropic-Cybersecurity-SkillsSecurityAudit pendingSnapshot f2dd063ebe1a

Summary

This source did not publish a separate summary. Review SKILL.md before using the skill.

SKILL.md

Conducting Internal Reconnaissance with BloodHound CE

Legal Notice: This skill is for authorized security testing and educational purposes only. Unauthorized use against systems you do not own or have written permission to test is illegal and may violate computer fraud laws.

Overview

BloodHound Community Edition (CE) is a modern, web-based Active Directory reconnaissance platform developed by SpecterOps that uses graph theory to reveal hidden relationships and attack paths within AD environments. Unlike the legacy BloodHound application, BloodHound CE uses a PostgreSQL backend with a dedicated graph database, providing improved performance, a modern web UI, and enhanced API capabilities. Red teams use BloodHound CE to collect AD objects, ACLs, sessions, group memberships, and trust relationships, then visualize attack paths from compromised low-privileged accounts to high-value targets like Domain Admins. The SharpHound collector (v2 for CE) gathers data from Active Directory, while AzureHound collects from Azure AD / Entra ID environments.

When to Use

When conducting security assessments that involve conducting internal reconnaissance with bloodhound ce
When following incident response procedures for related security events
When performing scheduled security testing or auditing activities
When validating security controls through hands-on testing

Prerequisites

Familiarity with red teaming concepts and tools
Access to a test or lab environment for safe execution
Python 3.8+ with required dependencies installed
Appropriate authorization for any testing activities

Objectives

Deploy BloodHound CE server using Docker Compose
Collect AD data using SharpHound v2 or BloodHound.py
Import collected data into BloodHound CE for graph analysis
Identify shortest attack paths from owned principals to Domain Admins
Discover ACL-based attack paths, Kerberoastable accounts, and delegation abuse

Deploy BloodHound CE using Docker Compose:

curl -L https://ghst.ly/getbhce -o docker-compose.yml
docker compose pull
docker compose up -d

Access the web interface at https://localhost:8080
Log in with the default admin credentials (displayed in Docker logs):
```
docker compose logs | grep "Initial Password"
```
Change the default admin password immediately

Transfer SharpHound v2 to the compromised Windows host:

# Execute full collection
.\SharpHound.exe -c All --outputdirectory C:\Temp

# DCOnly collection (LDAP only, stealthier)
.\SharpHound.exe -c DCOnly

# Session collection for logged-on user mapping
.\SharpHound.exe -c Session --loop --loopduration 02:00:00

# Collect from specific domain
.\SharpHound.exe -c All -d child.domain.local

Alternative: Use BloodHound.py from Linux:

bloodhound-python -u user -p 'Password123' -d domain.local -ns 10.10.10.1 -c All

Exfiltrate the generated ZIP file to the analysis workstation

Execute custom Cypher queries in the BloodHound CE search bar:

// Find shortest path from owned principals to Domain Admins
MATCH p=shortestPath((n {owned:true})-[*1..]->(m:Group {name:"DOMAIN [email protected]"}))
RETURN p

// Find Kerberoastable users with path to DA
MATCH (u:User {hasspn:true})
MATCH p=shortestPath((u)-[*1..]->(g:Group {name:"DOMAIN [email protected]"}))
RETURN p

// Find computers with sessions of DA members
MATCH (c:Computer)-[:HasSession]->(u:User)-[:MemberOf*1..]->(g:Group {name:"DOMAIN [email protected]"})
RETURN c.name, u.name

// Find ACL-based attack paths (GenericAll, WriteDACL, GenericWrite)
MATCH p=(u:User)-[:GenericAll|GenericWrite|WriteDacl|WriteOwner|ForceChangePassword*1..]->(t)
WHERE u.owned = true
RETURN p

// Find users who can DCSync
MATCH (u)-[:MemberOf*0..]->()-[:DCSync|GetChanges|GetChangesAll*1..]->(d:Domain)
RETURN u.name, d.name

// Find computers with LAPS but readable by non-admins
MATCH (c:Computer {haslaps:true})
MATCH p=(u:User)-[:ReadLAPSPassword]->(c)
RETURN p

Tool	Purpose	Platform
BloodHound CE	Web-based graph analysis platform	Docker
SharpHound v2	AD data collection (.NET, for CE)	Windows
BloodHound.py	AD data collection (Python)	Linux
AzureHound	Azure AD / Entra ID data collection	Cross-platform
PlumHound	Automated BloodHound reporting	Python
BloodHound Query Library	Community Cypher query repository	Web

Path Type	Description	Example
ACL Abuse	Exploit misconfigured ACLs	GenericAll on DA group
Kerberoasting	Crack service account passwords	SPN account → DA
AS-REP Roasting	Attack accounts without pre-auth	No-preauth user → password crack
Delegation Abuse	Exploit unconstrained/constrained delegation	Computer → impersonate DA
GPO Abuse	Modify GPOs applied to privileged OUs	GPO write → code execution on DA
Session Hijack	Leverage DA sessions on compromised hosts	Admin session → token theft

conducting-internal-reconnaissance-with-bloodhound-ce

Summary

SKILL.md

Conducting Internal Reconnaissance with BloodHound CE

Overview

When to Use

Prerequisites

Objectives

MITRE ATT&CK Mapping

Workflow

Phase 1: BloodHound CE Deployment

Phase 2: Data Collection with SharpHound v2

Phase 3: Data Import and Initial Analysis

Phase 4: Custom Cypher Queries

Phase 5: Attack Path Prioritization

Tools and Resources

Key Attack Path Types

Validation Criteria

Related skills