A structured overview of the BloodHound attack-path analysis ecosystem — official ingestors, community collectors, converters, ADWS alternatives, analysis tools, deployment helpers, and supporting frameworks.
Legend
- 🟢 Official — maintained by SpecterOps
- 🔵 Community — third-party / unofficial
- ⚫ Legacy — targets BloodHound ≤ 4.3 (pre-CE)
- Core Platform
- Deployment & Setup
- Ingestors
- GPO-Focused Tools
- Analysis, Reporting & Augmentation
- AI / MCP Integration
- Attack Path Exploitation
- Visualization Alternatives
- Data Conversion & Integration
- OpenGraph Collectors
- OpenGraph Developer Libraries
- Supporting Utilities
- Notes & Caveats
| Tool | Description | Links |
|---|---|---|
| BloodHound CE 🟢 | Open-source Community Edition. Graph-based attack path analysis powered by Neo4j + PostgreSQL. React/Go monolith. | GitHub · Docs |
| BloodHound Enterprise 🟢 | Commercial edition with continuous collection, managed deployment, and remediation guidance. | specterops.io |
| BloodHound Legacy ⚫ | Original Electron-based GUI (EOL). Superseded by CE. | GitHub |
Language: Go · Maintained by: SpecterOps
Official CLI for managing BloodHound CE instances — installation, server lifecycle management, log monitoring, and upgrades. Supports Windows, macOS, and Linux.
Language: Python · Author: Tanguy Boisset
Docker-based wrapper that automatically spins up and populates a new BloodHound CE instance. Useful for running multiple parallel assessment instances; integrates with the Neo4j Graph Data Science plugin for improved smartestPath performance.
Author: SySS Research (Adrian Vollmer)
Runs BloodHound CE in a single-user / no-login setup using Podman. Removes the authentication overhead for solo analysts who just want to load data and query it.
Language: Go · Author: Olaf Hartong @ FalconForce
Small Go tool that uploads collected JSON files directly to the BloodHound CE API (instead of the web UI), authenticating with a token ID/key pair. Useful for scripted or headless ingestion pipelines. For very large collections (15–20GB+), the author recommends splitting or zipping the JSON into smaller chunks first, since uploads are signed and loaded into memory before being sent — plan for enough RAM/swap.
./BHCEupload -tokenid <tokenid> -tokenkey <tokenkey> -dir <dir> -url <url>Tools that collect data from a live environment or an offline artifact and produce BloodHound-compatible graph data. Grouped by collection method.
Language: C# · Target: Active Directory (on-prem, Windows)
The primary and most complete AD ingestor. Enumerates domain objects via LDAP, collecting sessions, ACLs, group memberships, GPOs, trusts, ADCS, and more.
SharpHound.exe -c All --zipfilename output.zipLanguage: Go · Target: Entra ID (Azure AD) / Azure
Official Azure/Entra ID ingestor. Collects tenants, subscriptions, users, groups, service principals, roles, and resource relationships.
Tools that collect AD data the traditional way (LDAP) but are not official.
Language: Python · Target: Active Directory (remote, Linux-friendly)
Originally written by Dirk-jan Mollema, Edwin van Vliet, and Matthijs Gielen at Fox-IT (NCC Group). Now maintained by Dirk-jan Mollema (Outsider Security). Built on Impacket — enables remote collection without a Windows host. Two branches:
| Branch | Compatible with |
|---|---|
master |
BloodHound Legacy (≤ 4.3) ⚫ |
bloodhound-ce |
BloodHound CE 🔵 |
pip install bloodhound-ce
bloodhound-ce-python -d DOMAIN.LOCAL -u user -p pass -dc dc1 -c All --zipLanguage: Rust · Target: Active Directory (cross-platform, remote)
Cross-platform AD ingestor targeting BloodHound CE. Low noise, compiled for Linux/Windows/macOS. Supports Kerberos, LDAPS, ADCS, and FQDN resolution.
cargo install rusthound-ce
rusthound-ce -d DOMAIN.LOCAL -u user@DOMAIN.LOCAL -z- GitHub — RustHound-CE
- Legacy (BH ≤ 4.3): RustHound (NeverHack) ⚫
Language: Go · Target: BloodHound CE
Full AD ingestor with a terminal UI (TUI) for progress tracking. Designed to be faster, less noisy, and more configurable than traditional collectors. Supports remote collection via RPC and trust recursion.
go build ./cmd/flashingestorLanguage: Python · Author: Nick Swink @ Layer 8 Security
Makes a single LDAP query and caches the result to minimize network noise. Enumerates users, groups, computers, admins, OUs, kerberoastable accounts, and LDAP description fields. Outputs structured text files.
python silenthound.py -u user -p pass 10.10.10.100 DOMAIN.local -g -n -k --kerberoastLanguage: Python · Maintained by: Pennyw0rth community (successor to CrackMapExec)
Worth a caveat: NetExec is a general-purpose network-exploitation/pentesting swiss-army-knife, not a dedicated BloodHound ingestor — BloodHound support is one integration among many. Two relevant pieces:
- Built-in ingestor:
--bloodhound --collection <Method>runs a live LDAP collection using the same collection-method taxonomy as BloodHound.py (Mollema's tool, above) — it vendors that collection logic rather than reimplementing it. - Auto-"owned" marking: once Neo4j credentials are set in
~/.nxc/nxc.conf, NetExec automatically flags an account as Owned in the graph the moment it validates working creds for it (e.g. from a credential-dumping module hit). This writes directly to Neo4j over bolt, not through the BloodHound CE ingest API — it won't work if bolt access is firewalled off or Neo4j auth differs from the CE default, which is common in hardened deployments.
# ~/.nxc/nxc.conf
[BloodHound]
bh_enabled = True
bh_uri = 127.0.0.1
bh_port = 7687
bh_user = user
bh_pass = pass
# Collection
nxc ldap <ip> -u user -p pass --bloodhound --collection AllTools that collect AD data via the Active Directory Web Services (ADWS) protocol on TCP/9389 instead of LDAP. Harder to detect with LDAP-specific monitoring.
Language: C# (.NET) · Author: Nikos Karouzos @ FalconForce
Wraps LDAP queries inside SOAP/XML messages sent to the ADWS server via NetTCPBinding. LDAP traffic never appears on the wire. Requires a two-step process: build a cache first, then dump BH data. Compatible with BloodHound Legacy. Also collects ADCS and DNS data.
SOAPHound.exe --buildcache -c c:\temp\cache.txt
SOAPHound.exe -c c:\temp\cache.txt --bhdump -o c:\temp\bh-outputLanguage: Python · Author: j4s0nmo0n
Python reimplementation of the ADWS-based collection approach from SOAPHound. Integrates session collection from BloodHound.py. Supports Kerberos auth and ADCS enumeration (--cert-find).
⚠️ PyPI note: install aspip install soaphound-py— thesoaphoundpackage on PyPI is unrelated.
pip install soaphound-py
soaphound -d DOMAIN.local -u user -p pass -dc dc1.domain.localTools that convert existing data snapshots or logs into BloodHound-compatible JSON — no live connection to the domain needed.
Language: Python · Author: c3c
Converts Sysinternals AD Explorer .dat snapshots into BloodHound-compatible JSON (or BOFHound format, or raw NDJSON). The preferred output mode is BOFHound, which can then be processed by BOFHound itself. Entirely offline — no network interaction.
pip install git+https://github.com/c3c/ADExplorerSnapshot
ADExplorerSnapshot.py snapshot.dat -m BOFHound -o output/Limitation: no session or local group data (snapshot-only). Works with BloodHound v6 output format.
Language: Python · Authors: Adam Brown & Matt Creel (Fortalice / coffeegist)
Offline ingestor that parses log output from ldapsearch BOF (Cobalt Strike), pyldapsearch, Brute Ratel LDAP Sentinel, and Havoc into BloodHound-compatible JSON. Gives operators full control over which LDAP queries run and at what rate — useful for evading honeypots and detection thresholds.
⚠️ The original repo (fortalice/bofhound) is archived. The active maintained version is atcoffeegist/bofhound.
pip install bofhound
bofhound -o /data/ -i /opt/cobaltstrike/logs/Language: Python · Author: Adrian Vollmer @ SySS GmbH
Converts LDIF files (standard LDAP Data Interchange Format exports) into BloodHound-compatible JSON. Useful when you only have an LDIF dump and no live access. Equivalent in coverage to SharpHound -c DCOnly.
ldif2bloodhound dump.ldif -o output/Language: Python · Author: cogiceo (Cogiceo)
Dumps and analyzes GPOs from the SYSVOL share. Detects misconfigured registry settings, stored credentials, privilege rights (e.g. SeDebugPrivilege), VNC/GPP passwords, and members added to privileged local groups. Enriches BloodHound directly by writing new edges and node properties to Neo4j (requires APOC plugin). Includes custom Cypher queries.
gpohound sysvol --dc $DC -d $DOMAIN -u $USER -p $PASSWORD
gpohound ldap --dc $DC -d $DOMAIN -u $USER -p $PASSWORD
gpohound analysis --enrich-ceDetected edges added to BloodHound:
| Group | Edge |
|---|---|
| Administrators | AdminTo |
| Remote Desktop Users | CanRDP |
| Distributed COM Users | ExecuteDCOM |
| Remote Management Users | CanPSRemote |
| Backup/Print/Net Operators | CanPrivEsc |
Language: Python · Author: Riccardo Ancarani
Parses PowerView's GPO output to detect misconfigurations — URA (User Rights Assignments), SMB signing, and other insecure settings — and injects findings into BloodHound.
Language: Python · Maintained by: Grant Thornton Cybersecurity (originally Forvis Mazars)
Connects to the BloodHound CE Neo4j database and generates a static web-based audit report with risk ratings, mitigation paths, and time-evolution tracking. Supports "smartest path" mode with the Neo4j Graph Data Science plugin.
pip install ad-miner
AD-miner -cf MyReport -b bolt://127.0.0.1:7687 -u neo4j -p bloodhoundcommunityeditionLanguage: Python · Authors: Kent Ickler & Jordan Drysdale @ Black Hills Information Security
Wraps BloodHound's Neo4j Cypher queries into actionable operational reports (HTML/CSV). Designed for blue and purple teams to convert BloodHound graph data into consumable security deliverables. Uses community-driven "TaskLists" for query collections.
python3 PlumHound.py -x tasks/default.tasks -s bolt://127.0.0.1:7687 -u neo4j -p passLanguage: C# (.NET) · Author: improsec (JonasBK)
Windows GUI tool that overlays AD tiering onto your BloodHound graph. Assigns tier labels (T0/T1/T2) to nodes via OU structure, then identifies all edges that cross tier boundaries — i.e. paths that violate your tiering model. Exports violations as CSV.
Language: Python · Author: Mat Saulnier @ SpecterOps
Maps MITRE ATT&CK, Sigma rules, and Atomic Red Team data into BloodHound OpenGraph format. Bridges threat intelligence and attack path visualization for SOC/blue teams.
Language: Python · Author: Mor David
Analyzes DCSync output files from Mimikatz, Secretsdump, and SharpKatz, combines them with Hashcat cracked password results, and exports a combined Excel (xlsx) report. Can also load NTLM hashes and plaintext passwords directly into BloodHound as node properties.
Community-driven YAML collection of Cypher queries for BloodHound CE and Enterprise. Bulk-importable. Searchable frontend at queries.specterops.io.
Language: PowerShell · Author: SadProcessor @ SpecterOps
PowerShell client for BloodHound CE and Enterprise. CLI automation for API interactions, query management, and graph exploration ("dog whispering").
Language: Python · Author: Mor David
Connects BloodHound CE to an AI model via the Model Context Protocol (MCP). Lets security professionals query BloodHound attack paths using natural language instead of Cypher. Exposes 75+ Cypher-backed tools as MCP endpoints compatible with Claude, GPT-4, and other MCP-aware models.
"mcpServers": {
"BloodHound-MCP": {
"command": "python",
"args": ["BloodHound-MCP.py"],
"env": { "BLOODHOUND_URI": "bolt://localhost:7687", ... }
}
}Language: Python / PowerShell · Author: GoFetchAD (presented at Black Hat Europe 2016)
Automatically walks and executes a BloodHound-generated attack path step by step — dumping credentials with Mimikatz, pivoting with PsExec, and advancing node by node toward the target. Targets BloodHound Legacy path exports.
Language: Python · Author: CravateRouge
Automates exploitation of AD privilege-escalation paths surfaced by BloodHound CE. Splits into two stages: pathgen queries Neo4j (Dijkstra's algorithm, ideally with the GDS plugin) to compute the optimal weighted path between a source and target node, then autobloody connects to the DC and executes that path via the bloodyAD framework — supporting cleartext, pass-the-hash, pass-the-ticket, and certificate auth. Supported edges include GenericAll, WriteDacl, WriteOwner, Owns, AddMembers, DCSync, ForceChangePassword, and more. Cleans up reversible changes afterward (everything except password changes and owner changes).
pip install autobloody
autobloody -p 'Password123!' --host 192.168.10.2 -dp 'neo4jP@ss' -ds 'JOHN.DOE@BLOODY.LOCAL' -dt 'BLOODY.LOCAL'Language: JavaScript (browser) · Author: zrnge
100% browser-based, no server, no Neo4j, no install. Upload a SharpHound or AzureHound ZIP and get an interactive attack graph with:
- Risk-scored nodes (size and glow scale with risk)
- DCSync principals highlighted in red, high-value targets in gold
- ADCS, NTLM relay, unconstrained delegation views
- Full self-contained assessment report (Executive Summary, Critical Findings, Attack Paths, MITRE mapping)
Supports SharpHound v3/v4/v5 and BloodHound CE graph exports.
Language: Python / Ruby · Author: DotNetRussell
Parses SharpHound JSON output files without requiring a server or Neo4j. Designed for quick AD enumeration and analysis directly from the collected ZIP. Useful when you can't or don't want to stand up a BloodHound instance.
Language: Python · Author: Layer 8 Security
Converts BloodHound ZIP output files into formats importable into reporting tools like Dradis and Plextrac. Outputs an Nmap-XML formatted host file and a CSV of all discovered users.
python3 converthound.py convert BLOODHOUND_ZIP_FILEBloodHound's OpenGraph system lets any tool produce BloodHound-compatible graph data for non-AD environments. Full library at bloodhound.specterops.io/opengraph/library.
🟢 = SpecterOps project · 🔵 = Community project
| Tool | Coverage | Author |
|---|---|---|
| ADAttributeHound 🟢 | AD custom attributes as node properties | Martin Sohn Christensen @ SpecterOps |
| ManagerOfHound 🟢 | Manager–subordinate delegation paths | Martin Sohn Christensen @ SpecterOps |
| ProfileHound 🔵 | User profiles on machines (HasUserProfile edge) |
Chris Haller @ Omada Technologies |
| WinSSHound 🔵 | SSH lateral movement via misconfigured Windows SSH servers | Robin Unglaub @ ProSec GmbH |
| Tool | Coverage | Author |
|---|---|---|
| EntraSSSOHound 🟢 | Entra Seamless SSO trust paths | Daniel Heinsen @ SpecterOps |
| EntraAuthPolicyHound 🟢 | TAP & Passkey (FIDO2) policy coverage | Michael Grafnetter @ SpecterOps |
| OktaHound 🟢 | Okta users, groups, apps, roles | Michael Grafnetter @ SpecterOps |
| DuoHound 🟢 | Cisco Duo MFA / enrollment gaps | Jacob Julian @ SpecterOps |
| PingOneHound 🟢 | Ping Identity / PingOne | Andy Robbins @ SpecterOps |
| GCP-Hound 🔵 | GCP IAM privilege escalation | Faiz Karim |
| GCPwn 🔵 | GCP offensive assessment + OpenGraph output | WebbinRoot @ NetSPI |
| OCInferno 🔵 | Oracle Cloud Infrastructure | WebbinRoot @ NetSPI |
| IAMhounddog 🔵 | AWS IAM privilege escalation | Nathan Tucker @ Virtue Security |
| Tool | Coverage | Author |
|---|---|---|
| GitHound 🟢 | GitHub orgs, permissions, repos | Jared Atkinson @ SpecterOps |
| GitLabHound 🔵 | GitLab + OIDC/SSO paths, CI/CD pipelines | Marc André Tanner @ Compass Security |
| AtlassianHound 🟢 | Jira & Confluence access | Craig Wright @ SpecterOps |
| Dop2Mop 🔵 | DevOps → MLOps paths (GitHub, AzDO, Azure ML, SageMaker) | Brett Hawkins @ Armadin |
| AnsibleHound 🔵 | Ansible AWX / Tower | Ramoreik, s-lck |
| Tool | Coverage | Author |
|---|---|---|
| MSSQLHound 🟢 | MSSQL server permissions | Chris Thompson @ SpecterOps |
| ConfigManBearPig 🟢 | SCCM / Config Manager attack paths | Chris Thompson @ SpecterOps |
| SCOMHound 🟢 | System Center Operations Manager | Garrett Foster @ SpecterOps |
| JamfHound 🟢 | Jamf Pro MDM permissions | Lance Cain @ SpecterOps |
| TailscaleHound 🟢 | Tailscale mesh network + ACLs | Andrew Gomez & Andrew Luke @ SpecterOps |
| vCenterHound 🔵 | VMware vCenter infrastructure + permissions | Mor David |
| NetworkHound 🔵 | Shadow IT discovery, AD computer IP resolution | Mor David |
| ClusterHound 🔵 | Kubernetes RBAC + multi-hop attack paths | Nathan Dove & Josh Hickling @ KPMG UK |
| ExchangeHound 🔵 | MS Exchange delegation, RBAC, transport rules | Filip Wozniak |
| runZeroHound 🔵 | runZero exposure management data | HD Moore @ runZero |
| IDMHound 🔵 | FreeIPA / Red Hat Identity Management | Samuel Bovy |
| RacfHound 🔵 | z/OS mainframe RACF database (via SSH) | Alexander Henriksson |
| Tool | Coverage | Author |
|---|---|---|
| 1PassHound 🟢 | 1Password for Business vault ACLs | Jared Atkinson @ SpecterOps |
| SnowHound 🟢 | Snowflake users, roles, databases | Jared Atkinson @ SpecterOps |
| CyberArkHound 🔵 | CyberArk PVWA safes, accounts | Javier Azofra & Julian Garcia @ Siemens Healthineers |
| ForceHound 🔵 | Salesforce IAM, profiles, permission sets | Weylon Solis @ NetSPI |
| SFHound 🔵 | Salesforce roles, connected apps, OLS | Kaden Butt |
| Tool | Coverage | Author |
|---|---|---|
| SecretHound 🟢 | Secret scan results → BloodHound (TruffleHog, NoseyParker, Nemesis) | JD Crandell @ SpecterOps |
| AIHound 🔵 | AI credential & secrets scanning | dfirdeferred @ Netwrix |
| Tool | Coverage | Author |
|---|---|---|
| PrivHound 🔵 | 29 local privesc categories, multi-hop chains, MITRE mapping | Arun Nair |
| ShareHound 🟢 | Network shares, permissions, and paths at scale | Remi Gascou @ SpecterOps |
| TaskHound 🔵 | Privileged Windows scheduled tasks with stored credentials (SMB) | Robin Unglaub @ ProSec GmbH |
| Library | Language | Description | Link |
|---|---|---|---|
| OpenHound 🟢 | Python (DLT) | Standardized framework for building OpenGraph collectors. Collect-first, convert-later pipeline with auto-generated CLI. | GitHub |
| bhopengraph 🟢 | Python | Python classes for creating OpenGraph-compatible graph structures. Full docs at bhopengraph.readthedocs.io. | GitHub |
| gopengraph 🟢 | Go | Go types and helpers for OpenGraph-compatible data structures. | GitHub |
| bloodhound-opengraph 🔵 | Python | Lightweight Python library for producing OpenGraph JSON conforming to the data payload schema. | GitHub |
| Tool | Description | Link |
|---|---|---|
| ScrappyDoo 🟢 | Self-hosted web app for manually generating OpenGraph-compatible JSON. | GitHub |
| HoundTrainer 🔵 | Manages custom node icons and Cypher queries in BloodHound via API (CRUD, export, bulk reset). | GitHub |
BloodHound CE vs Legacy: Many community tools have separate branches or versions for each. When choosing a collector, verify CE compatibility. Tools targeting BloodHound ≤ 4.3 are marked ⚫.
bofhound moved: The original fortalice/bofhound repo is archived and no longer maintained. The current active repo is coffeegist/bofhound.
SOAPHound CE support: SOAPHound currently targets BloodHound Legacy (v4). CE-compatible output is on the roadmap but not yet released.
ADExplorerSnapshot.py note: The default output mode is now BOFHound (not BloodHound). Run BOFHound afterward to convert to BH JSON. The .py in the repo name is vestigial — the current repo is c3c/ADExplorerSnapshot (without the .py).
OpenGraph: SpecterOps's extension system that lets any tool produce BloodHound-compatible graph data for non-AD environments. See bloodhound.specterops.io/opengraph.
No official endorsement: Community tools are not audited by SpecterOps. Use at your own risk in production or sensitive environments.
Sources: SpecterOps OpenGraph Library · BloodHound Docs · individual project READMEs · July 2026.
This is awesome!