A structured overview of the BloodHound attack-path analysis ecosystem — official ingestors, community collectors, converters, ADWS alternatives, analysis tools, deployment helpers, and supporting frameworks.
Legend
- 🟢 Official — maintained by SpecterOps
- 🔵 Community — third-party / unofficial
- ⚫ Legacy — targets BloodHound ≤ 4.3 (pre-CE)
| Tool | Description | Links |
|---|---|---|
| BloodHound CE 🟢 | Open-source Community Edition. Graph-based attack path analysis powered by Neo4j + PostgreSQL. React/Go monolith. | GitHub · Docs |
| BloodHound Enterprise 🟢 | Commercial edition with continuous collection, managed deployment, and remediation guidance. | specterops.io |
| BloodHound Legacy ⚫ | Original Electron-based GUI (EOL). Superseded by CE. | GitHub |
Language: Go · Maintained by: SpecterOps
Official CLI for managing BloodHound CE instances — installation, server lifecycle management, log monitoring, and upgrades. Supports Windows, macOS, and Linux.
Language: Python · Author: Tanguy Boisset
Docker-based wrapper that automatically spins up and populates a new BloodHound CE instance. Useful for running multiple parallel assessment instances; integrates with the Neo4j Graph Data Science plugin for improved smartestPath performance.
Author: SySS Research (Adrian Vollmer)
Runs BloodHound CE in a single-user / no-login setup using Podman. Removes the authentication overhead for solo analysts who just want to load data and query it.
Language: C# · Target: Active Directory (on-prem, Windows)
The primary and most complete AD ingestor. Enumerates domain objects via LDAP, collecting sessions, ACLs, group memberships, GPOs, trusts, ADCS, and more.
SharpHound.exe -c All --zipfilename output.zipLanguage: Go · Target: Entra ID (Azure AD) / Azure
Official Azure/Entra ID ingestor. Collects tenants, subscriptions, users, groups, service principals, roles, and resource relationships.
Tools that collect AD data the traditional way (LDAP) but are not official.
Language: Python · Target: Active Directory (remote, Linux-friendly)
Originally written by Dirk-jan Mollema, Edwin van Vliet, and Matthijs Gielen at Fox-IT (NCC Group). Now maintained by Dirk-jan Mollema (Outsider Security). Built on Impacket — enables remote collection without a Windows host. Two branches:
| Branch | Compatible with |
|---|---|
master |
BloodHound Legacy (≤ 4.3) ⚫ |
bloodhound-ce |
BloodHound CE 🔵 |
pip install bloodhound-ce
bloodhound-ce-python -d DOMAIN.LOCAL -u user -p pass -dc dc1 -c All --zipLanguage: Rust · Target: Active Directory (cross-platform, remote)
Cross-platform AD ingestor targeting BloodHound CE. Low noise, compiled for Linux/Windows/macOS. Supports Kerberos, LDAPS, ADCS, and FQDN resolution.
cargo install rusthound-ce
rusthound-ce -d DOMAIN.LOCAL -u user@DOMAIN.LOCAL -z- GitHub — RustHound-CE
- Legacy (BH ≤ 4.3): RustHound (NeverHack) ⚫
Language: Go · Target: BloodHound CE
Full AD ingestor with a terminal UI (TUI) for progress tracking. Designed to be faster, less noisy, and more configurable than traditional collectors. Supports remote collection via RPC and trust recursion.
go build ./cmd/flashingestorLanguage: Python · Author: Nick Swink @ Layer 8 Security
Makes a single LDAP query and caches the result to minimize network noise. Enumerates users, groups, computers, admins, OUs, kerberoastable accounts, and LDAP description fields. Outputs structured text files.
python silenthound.py -u user -p pass 10.10.10.100 DOMAIN.local -g -n -k --kerberoastTools that collect AD data via the Active Directory Web Services (ADWS) protocol on TCP/9389 instead of LDAP. Harder to detect with LDAP-specific monitoring.
Language: C# (.NET) · Author: Nikos Karouzos @ FalconForce
Wraps LDAP queries inside SOAP/XML messages sent to the ADWS server via NetTCPBinding. LDAP traffic never appears on the wire. Requires a two-step process: build a cache first, then dump BH data. Compatible with BloodHound Legacy. Also collects ADCS and DNS data.
SOAPHound.exe --buildcache -c c:\temp\cache.txt
SOAPHound.exe -c c:\temp\cache.txt --bhdump -o c:\temp\bh-outputLanguage: Python · Author: j4s0nmo0n
Python reimplementation of the ADWS-based collection approach from SOAPHound. Integrates session collection from BloodHound.py. Supports Kerberos auth and ADCS enumeration (--cert-find).
⚠️ PyPI note: install aspip install soaphound-py— thesoaphoundpackage on PyPI is unrelated.
pip install soaphound-py
soaphound -d DOMAIN.local -u user -p pass -dc dc1.domain.localTools that convert existing data snapshots or logs into BloodHound-compatible JSON — no live connection to the domain needed.
Language: Python · Author: c3c
Converts Sysinternals AD Explorer .dat snapshots into BloodHound-compatible JSON (or BOFHound format, or raw NDJSON). The preferred output mode is BOFHound, which can then be processed by BOFHound itself. Entirely offline — no network interaction.
pip install git+https://github.com/c3c/ADExplorerSnapshot
ADExplorerSnapshot.py snapshot.dat -m BOFHound -o output/Limitation: no session or local group data (snapshot-only). Works with BloodHound v6 output format.
Language: Python · Authors: Adam Brown & Matt Creel (Fortalice / coffeegist)
Offline ingestor that parses log output from ldapsearch BOF (Cobalt Strike), pyldapsearch, Brute Ratel LDAP Sentinel, and Havoc into BloodHound-compatible JSON. Gives operators full control over which LDAP queries run and at what rate — useful for evading honeypots and detection thresholds.
⚠️ The original repo (fortalice/bofhound) is archived. The active maintained version is atcoffeegist/bofhound.
pip install bofhound
bofhound -o /data/ -i /opt/cobaltstrike/logs/Language: Python · Author: Adrian Vollmer @ SySS GmbH
Converts LDIF files (standard LDAP Data Interchange Format exports) into BloodHound-compatible JSON. Useful when you only have an LDIF dump and no live access. Equivalent in coverage to SharpHound -c DCOnly.
ldif2bloodhound dump.ldif -o output/Language: Python · Author: cogiceo (Cogiceo)
Dumps and analyzes GPOs from the SYSVOL share. Detects misconfigured registry settings, stored credentials, privilege rights (e.g. SeDebugPrivilege), VNC/GPP passwords, and members added to privileged local groups. Enriches BloodHound directly by writing new edges and node properties to Neo4j (requires APOC plugin). Includes custom Cypher queries.
gpohound sysvol --dc $DC -d $DOMAIN -u $USER -p $PASSWORD
gpohound ldap --dc $DC -d $DOMAIN -u $USER -p $PASSWORD
gpohound analysis --enrich-ceDetected edges added to BloodHound:
| Group | Edge |
|---|---|
| Administrators | AdminTo |
| Remote Desktop Users | CanRDP |
| Distributed COM Users | ExecuteDCOM |
| Remote Management Users | CanPSRemote |
| Backup/Print/Net Operators | CanPrivEsc |
Language: Python · Author: Riccardo Ancarani
Parses PowerView's GPO output to detect misconfigurations — URA (User Rights Assignments), SMB signing, and other insecure settings — and injects findings into BloodHound.
Language: Python · Maintained by: Grant Thornton Cybersecurity (originally Forvis Mazars)
Connects to the BloodHound CE Neo4j database and generates a static web-based audit report with risk ratings, mitigation paths, and time-evolution tracking. Supports "smartest path" mode with the Neo4j Graph Data Science plugin.
pip install ad-miner
AD-miner -cf MyReport -b bolt://127.0.0.1:7687 -u neo4j -p bloodhoundcommunityeditionLanguage: Python · Authors: Kent Ickler & Jordan Drysdale @ Black Hills Information Security
Wraps BloodHound's Neo4j Cypher queries into actionable operational reports (HTML/CSV). Designed for blue and purple teams to convert BloodHound graph data into consumable security deliverables. Uses community-driven "TaskLists" for query collections.
python3 PlumHound.py -x tasks/default.tasks -s bolt://127.0.0.1:7687 -u neo4j -p passLanguage: C# (.NET) · Author: improsec (JonasBK)
Windows GUI tool that overlays AD tiering onto your BloodHound graph. Assigns tier labels (T0/T1/T2) to nodes via OU structure, then identifies all edges that cross tier boundaries — i.e. paths that violate your tiering model. Exports violations as CSV.
Language: Python · Author: Mat Saulnier @ SpecterOps
Maps MITRE ATT&CK, Sigma rules, and Atomic Red Team data into BloodHound OpenGraph format. Bridges threat intelligence and attack path visualization for SOC/blue teams.
Language: Python · Author: Mor David
Analyzes DCSync output files from Mimikatz, Secretsdump, and SharpKatz, combines them with Hashcat cracked password results, and exports a combined Excel (xlsx) report. Can also load NTLM hashes and plaintext passwords directly into BloodHound as node properties.
Community-driven YAML collection of Cypher queries for BloodHound CE and Enterprise. Bulk-importable. Searchable frontend at queries.specterops.io.
Language: PowerShell · Author: SadProcessor @ SpecterOps
PowerShell client for BloodHound CE and Enterprise. CLI automation for API interactions, query management, and graph exploration ("dog whispering").
Language: Python · Author: Mor David
Connects BloodHound CE to an AI model via the Model Context Protocol (MCP). Lets security professionals query BloodHound attack paths using natural language instead of Cypher. Exposes 75+ Cypher-backed tools as MCP endpoints compatible with Claude, GPT-4, and other MCP-aware models.
"mcpServers": {
"BloodHound-MCP": {
"command": "python",
"args": ["BloodHound-MCP.py"],
"env": { "BLOODHOUND_URI": "bolt://localhost:7687", ... }
}
}Language: Python / PowerShell · Author: GoFetchAD (presented at Black Hat Europe 2016)
Automatically walks and executes a BloodHound-generated attack path step by step — dumping credentials with Mimikatz, pivoting with PsExec, and advancing node by node toward the target. Targets BloodHound Legacy path exports.
Language: JavaScript (browser) · Author: zrnge
100% browser-based, no server, no Neo4j, no install. Upload a SharpHound or AzureHound ZIP and get an interactive attack graph with:
- Risk-scored nodes (size and glow scale with risk)
- DCSync principals highlighted in red, high-value targets in gold
- ADCS, NTLM relay, unconstrained delegation views
- Full self-contained assessment report (Executive Summary, Critical Findings, Attack Paths, MITRE mapping)
Supports SharpHound v3/v4/v5 and BloodHound CE graph exports.
Language: Python / Ruby · Author: DotNetRussell
Parses SharpHound JSON output files without requiring a server or Neo4j. Designed for quick AD enumeration and analysis directly from the collected ZIP. Useful when you can't or don't want to stand up a BloodHound instance.
Language: Python · Author: Layer 8 Security
Converts BloodHound ZIP output files into formats importable into reporting tools like Dradis and Plextrac. Outputs an Nmap-XML formatted host file and a CSV of all discovered users.
python3 converthound.py convert BLOODHOUND_ZIP_FILEBloodHound's OpenGraph system lets any tool produce BloodHound-compatible graph data for non-AD environments. Full library at bloodhound.specterops.io/opengraph/library.
🟢 = SpecterOps project · 🔵 = Community project
| Tool | Coverage | Author |
|---|---|---|
| ADAttributeHound 🟢 | AD custom attributes as node properties | Martin Sohn Christensen @ SpecterOps |
| ManagerOfHound 🟢 | Manager–subordinate delegation paths | Martin Sohn Christensen @ SpecterOps |
| ProfileHound 🔵 | User profiles on machines (HasUserProfile edge) |
Chris Haller @ Omada Technologies |
| WinSSHound 🔵 | SSH lateral movement via misconfigured Windows SSH servers | Robin Unglaub @ ProSec GmbH |
| Tool | Coverage | Author |
|---|---|---|
| EntraSSSOHound 🟢 | Entra Seamless SSO trust paths | Daniel Heinsen @ SpecterOps |
| EntraAuthPolicyHound 🟢 | TAP & Passkey (FIDO2) policy coverage | Michael Grafnetter @ SpecterOps |
| OktaHound 🟢 | Okta users, groups, apps, roles | Michael Grafnetter @ SpecterOps |
| DuoHound 🟢 | Cisco Duo MFA / enrollment gaps | Jacob Julian @ SpecterOps |
| PingOneHound 🟢 | Ping Identity / PingOne | Andy Robbins @ SpecterOps |
| GCP-Hound 🔵 | GCP IAM privilege escalation | Faiz Karim |
| GCPwn 🔵 | GCP offensive assessment + OpenGraph output | WebbinRoot @ NetSPI |
| OCInferno 🔵 | Oracle Cloud Infrastructure | WebbinRoot @ NetSPI |
| IAMhounddog 🔵 | AWS IAM privilege escalation | Nathan Tucker @ Virtue Security |
| Tool | Coverage | Author |
|---|---|---|
| GitHound 🟢 | GitHub orgs, permissions, repos | Jared Atkinson @ SpecterOps |
| GitLabHound 🔵 | GitLab + OIDC/SSO paths, CI/CD pipelines | Marc André Tanner @ Compass Security |
| AtlassianHound 🟢 | Jira & Confluence access | Craig Wright @ SpecterOps |
| Dop2Mop 🔵 | DevOps → MLOps paths (GitHub, AzDO, Azure ML, SageMaker) | Brett Hawkins @ Armadin |
| AnsibleHound 🔵 | Ansible AWX / Tower | Ramoreik, s-lck |
| Tool | Coverage | Author |
|---|---|---|
| MSSQLHound 🟢 | MSSQL server permissions | Chris Thompson @ SpecterOps |
| ConfigManBearPig 🟢 | SCCM / Config Manager attack paths | Chris Thompson @ SpecterOps |
| SCOMHound 🟢 | System Center Operations Manager | Garrett Foster @ SpecterOps |
| JamfHound 🟢 | Jamf Pro MDM permissions | Lance Cain @ SpecterOps |
| TailscaleHound 🟢 | Tailscale mesh network + ACLs | Andrew Gomez & Andrew Luke @ SpecterOps |
| vCenterHound 🔵 | VMware vCenter infrastructure + permissions | Mor David |
| NetworkHound 🔵 | Shadow IT discovery, AD computer IP resolution | Mor David |
| ClusterHound 🔵 | Kubernetes RBAC + multi-hop attack paths | Nathan Dove & Josh Hickling @ KPMG UK |
| ExchangeHound 🔵 | MS Exchange delegation, RBAC, transport rules | Filip Wozniak |
| runZeroHound 🔵 | runZero exposure management data | HD Moore @ runZero |
| IDMHound 🔵 | FreeIPA / Red Hat Identity Management | Samuel Bovy |
| RacfHound 🔵 | z/OS mainframe RACF database (via SSH) | Alexander Henriksson |
| Tool | Coverage | Author |
|---|---|---|
| 1PassHound 🟢 | 1Password for Business vault ACLs | Jared Atkinson @ SpecterOps |
| SnowHound 🟢 | Snowflake users, roles, databases | Jared Atkinson @ SpecterOps |
| CyberArkHound 🔵 | CyberArk PVWA safes, accounts | Javier Azofra & Julian Garcia @ Siemens Healthineers |
| ForceHound 🔵 | Salesforce IAM, profiles, permission sets | Weylon Solis @ NetSPI |
| SFHound 🔵 | Salesforce roles, connected apps, OLS | Kaden Butt |
| Tool | Coverage | Author |
|---|---|---|
| SecretHound 🟢 | Secret scan results → BloodHound (TruffleHog, NoseyParker, Nemesis) | JD Crandell @ SpecterOps |
| AIHound 🔵 | AI credential & secrets scanning | dfirdeferred @ Netwrix |
| Tool | Coverage | Author |
|---|---|---|
| PrivHound 🔵 | 29 local privesc categories, multi-hop chains, MITRE mapping | Arun Nair |
| ShareHound 🟢 | Network shares, permissions, and paths at scale | Remi Gascou @ SpecterOps |
| TaskHound 🔵 | Privileged Windows scheduled tasks with stored credentials (SMB) | Robin Unglaub @ ProSec GmbH |
| Library | Language | Description | Link |
|---|---|---|---|
| OpenHound 🟢 | Python (DLT) | Standardized framework for building OpenGraph collectors. Collect-first, convert-later pipeline with auto-generated CLI. | GitHub |
| bhopengraph 🟢 | Python | Python classes for creating OpenGraph-compatible graph structures. Full docs at bhopengraph.readthedocs.io. | GitHub |
| gopengraph 🟢 | Go | Go types and helpers for OpenGraph-compatible data structures. | GitHub |
| bloodhound-opengraph 🔵 | Python | Lightweight Python library for producing OpenGraph JSON conforming to the data payload schema. | GitHub |
| Tool | Description | Link |
|---|---|---|
| ScrappyDoo 🟢 | Self-hosted web app for manually generating OpenGraph-compatible JSON. | GitHub |
| HoundTrainer 🔵 | Manages custom node icons and Cypher queries in BloodHound via API (CRUD, export, bulk reset). | GitHub |
BloodHound CE vs Legacy: Many community tools have separate branches or versions for each. When choosing a collector, verify CE compatibility. Tools targeting BloodHound ≤ 4.3 are marked ⚫.
bofhound moved: The original fortalice/bofhound repo is archived and no longer maintained. The current active repo is coffeegist/bofhound.
SOAPHound CE support: SOAPHound currently targets BloodHound Legacy (v4). CE-compatible output is on the roadmap but not yet released.
ADExplorerSnapshot.py note: The default output mode is now BOFHound (not BloodHound). Run BOFHound afterward to convert to BH JSON. The .py in the repo name is vestigial — the current repo is c3c/ADExplorerSnapshot (without the .py).
OpenGraph: SpecterOps's extension system that lets any tool produce BloodHound-compatible graph data for non-AD environments. See bloodhound.specterops.io/opengraph.
No official endorsement: Community tools are not audited by SpecterOps. Use at your own risk in production or sensitive environments.
Sources: SpecterOps OpenGraph Library · BloodHound Docs · individual project READMEs · July 2026.
