🩸 BloodHound

Needs a valid credential first. Graphs attack paths across the domain.

Collection

Import-Module .\Sharphound.ps1       # or use SharpHound.exe
Invoke-BloodHound -CollectionMethod All -OutputDirectory C:\Users\stephanie\Desktop\ -OutputPrefix "corp audit"

# Linux-side collection
bloodhound.py -d domain.name -u user -p pass -c all -ns 192.168.219.122
nxc ldap Nara.nara-security.com -u 'Tracy.White' -p 'zqwj041FGX' --bloodhound -ns 192.168.232.30 --collection All
# Certipy BloodHound data (certificate paths)
certipy-ad find -u JODIE.SUMMERS -p '...' -dc-ip nara-security.com -dns-tcp -ns 172.16.201.26 -bloodhound

Run

sudo neo4j console
sudo bloodhound
# then upload the JSON/ZIP and open the Analysis tab

Look for Find-LocalAdminAccess, shortest paths to Domain Admins, GenericAll/WriteDacl edges. Exploit those in methodology and tools.