Skip to main content
Back to Blog

BloodHound for Pentesters: Attack Path Discovery Guide

Use BloodHound CE and classic BloodHound for AD attack path analysis — collection, dangerous permissions, and documenting paths for reports.

BloodHound Turns Graph Noise Into Paths

BloodHound maps Active Directory relationships — group membership, ACLs, sessions, and trust edges — so you see shortest paths to Domain Admin instead of guessing. BloodHound CE and the SharpHound collector remain staples of internal and red team engagements.

Collection Best Practices

  • Run SharpHound from a stable foothold with sufficient domain read access
  • Collect session data during business hours when paths are meaningful
  • Mark owned nodes as you compromise accounts — paths update dynamically
  • Export high-value paths as evidence for the final report

From Graph to Execution

Translate BloodHound edges into Attack Chain steps: GenericAll on user → reset password → RDP to workstation → local admin → DCSync. HackFast Attack Chain Builder stores each step with expected outcome and links to the hosts and credentials involved — so the graph is not trapped in Neo4j screenshots alone.

Build attack chains on HackFast.