BloodHound: Mapping Active Directory Attack Paths

BloodHound answers a question that is almost impossible to answer by hand: given a foothold anywhere in your Active Directory, what is the path to full control? It collects the relationships in your AD , who is an admin where, which accounts can reset which passwords, which groups nest inside which , and draws them as a graph. Then it finds the shortest path from any starting point to Domain Admin. Attackers use it to plan; defenders use it to see the paths before attackers walk them.

It is one of the most important tools in modern Active Directory security, because it exposes risk that is invisible in any other view.

The problem it solves

Active Directory in a real organisation is a dense web of permissions accumulated over years , nested groups, delegated rights, service accounts, legacy access nobody remembers granting. No administrator holds this in their head, and no console shows it as a whole. The dangerous consequence is that a chain of individually reasonable permissions can add up to a path a normal user can follow all the way to Domain Admin , and nobody realises the chain exists.

BloodHound makes that chain visible. It turns “we think our AD is reasonably locked down” into a map you can actually inspect.

How it works

Collection. A collector (SharpHound, or its equivalents) gathers data from AD , users, groups, computers, sessions, permissions (ACLs), group memberships, and trust relationships. Much of this is readable by any authenticated user, which is itself part of the point: an attacker with any foothold can gather it.

Analysis. BloodHound loads that data into a graph database and represents it visually , nodes are users, groups, and computers; edges are relationships like “is a member of,” “can reset the password of,” “has admin rights on,” or “has a session on.” Each edge is a potential step in an attack.

Path-finding. The decisive feature: pick any node and ask for the shortest path to Domain Admin (or any other target). BloodHound computes the route through the graph , “this ordinary user can reset that account’s password, which is in a group that admins these servers, one of which has a Domain Admin session to steal.” It finds in seconds what would take a human days, if they found it at all.

What its findings reveal

A BloodHound-driven finding usually describes an attack path rather than a single flaw, and each points to something specific to fix:

• Short paths from ordinary users to Domain Admin , the headline finding. A low-privilege account should not be a few hops from total control. Each hop is a permission to review.
• Dangerous ACLs , accounts with rights to reset passwords, modify group membership, or alter objects they have no business touching, often through forgotten delegation.
• Excessive local admin rights , users who are administrators on far more machines than their role requires, widening every attack.
• Kerberoastable and high-value accounts on the path , service accounts whose compromise (see Impacket’s GetUserSPNs) unlocks a step toward the goal.
• Credential-exposure through sessions , where a high-privilege account is logged on to a machine a lower-privilege attacker can reach.

The value is that these are relationships, not missing patches. No vulnerability scanner finds them, because nothing is technically broken , the risk is in how the permissions combine.

From attacker’s map to defender’s tool

BloodHound is genuinely dual-use, and the defensive use is powerful. Run against your own directory, it lets you:

• Find and cut the paths to Domain Admin before an attacker does , removing an ACL, un-nesting a group, or reducing local admin rights can delete an entire attack path at once.
• Measure your AD’s exposure , how many users can reach Domain Admin, and how quickly. That is a concrete, trackable security metric.
• Prioritise , fix the permissions that appear on the most paths first, for the greatest reduction in risk per change.

This is why an AD-focused penetration test does not just use BloodHound to attack , it hands you the graph so your team can keep closing paths after the engagement ends.

Where it fits in an engagement

BloodHound is central to the analysis phase of Active Directory attacks in internal network penetration testing and red team assessments. After an initial foothold , often obtained with Responder or a Kerbrute password spray , BloodHound plans the route to the objective, and tools like NetExec and Impacket walk it. In the report, the BloodHound graph is often the single most useful artifact, because it shows your team exactly which relationships to sever.

The short version

BloodHound maps the tangled web of Active Directory permissions and finds the shortest path from any foothold to Domain Admin , exposing attack paths built from individually reasonable permissions that no console shows as a whole. Its findings are relationships, not missing patches, which is precisely why they hide from scanners and why they matter. And it is a defender’s tool as much as an attacker’s: run against your own AD, it shows you exactly which permissions to cut to delete an attack path entirely.

Want to see the actual paths from an ordinary user to Domain Admin inside your network , and a map for closing them? That analysis is core to every internal network penetration test we run. Scope one here.