bloodhound maps the shortest path to domain admin

your active directory is a graph, whether you planned it that way or not

every domain admin group, every nested "helpdesk_l2" group, every service account with local admin rights on twelve servers, all of it forms a web of relationships. attackers don't need to guess passwords all day. they just need to find one low-privilege foothold and then ask a graph "what's the shortest way from here to domain admin." bloodhound is the tool that answers that question in seconds, and if you're defending a windows domain, you need to be asking it before someone else does.

what bloodhound actually collects

bloodhound doesn't exploit anything. it just reads. it pulls data straight out of active directory using normal, authenticated queries: who's in what group, who has admin rights on which machine, who can reset whose password, which sessions are active where. none of that requires special access, just a valid domain account, which is exactly why it's so dangerous in the wrong hands and so useful in the right ones.

bloodhound-python -d corp.local -u user -p pass -c all -ns 10.0.0.10

breaking that down:

-d corp.local is the domain you're pointing at. -u user -p pass is any valid domain credential, doesn't need to be privileged. -c all tells it to collect everything it knows how to grab: users, groups, computers, sessions, acls, group policy, trusts. -ns 10.0.0.10 points it at a specific dns server or domain controller so it's not relying on whatever dns your local machine happens to be configured with.

the part that actually matters: asking the question

collecting the data is step one. the real move happens in the bloodhound console, where you load that data into a graph database and ask "shortest path from [account i have] to domain admins." this is the same question an attacker asks after landing a single phished credential. the answer is often depressingly short: three hops through a helpdesk group that was given "genericall" rights on a service account five years ago, and nobody ever revisited it. that path has probably existed since before you were hired.

why defenders should run this against themselves

every attack path bloodhound finds is a path that already exists in your environment right now, today, whether or not you ever run the tool. running it yourself doesn't create risk, it just makes the invisible visible. security teams that skip this step are relying on hope, which is not a control.

run it in a lab or against your own domain with proper authorization, and look specifically for:

unconstrained delegation on servers that don't need it, which lets an attacker harvest tickets and impersonate anyone who connects.

nested group chains where a low-privilege group somehow inherits high-privilege rights three groups up, because someone added "IT_Support" to "Server_Admins" for a project in 2019 and forgot to remove it.

service accounts with stale permissions, especially ones with logon rights or admin access on machines they haven't touched in years.

kerberoastable accounts, service accounts with weak passwords whose ticket-granting service tickets can be cracked offline once obtained.

shutting down the paths, not just finding them

finding the graph is only useful if you prune it. once you've mapped your own attack paths, the fixes are usually boring and unglamorous, which is exactly why they get skipped:

remove unused group nestings and stale acl entries, don't just document them and move on. audit every account with genericall, genericwrite, writedacl, or writeowner rights on sensitive objects, these are the acl abuses that build most attack paths. rotate service account passwords regularly and use long, randomly generated ones so kerberoasting doesn't work. disable unconstrained delegation unless you have a specific, documented reason to keep it. put domain admins and other tier-0 accounts in a protected users group and make sure they never log into lower-tier machines.

also, treat "who has local admin on what" as a living inventory, not a one-time cleanup. attack paths regrow. they're mostly made of small, well-intentioned permission grants that nobody ever revokes, which means the graph needs to be re-checked, not fixed once and forgotten.

the takeaway

bloodhound doesn't hack anything, it just shows you the map that already exists inside your directory. attackers use that map to find the fastest way to the crown jewels. your job as a defender is to walk that same path first, close the shortcuts, and check back regularly, because every new hire, every new group, and every "just give it admin for now" ticket adds a new edge to the graph.