# 3.3.2 - BloodHound
## **BloodHound**
Most famous tool that provides GUI for AD entities and relationship for the data collected. It utilzies graph theory mapping shortest path for interesting things like Domain Admins, and contains built-in queries for more interesting path.
There two free versions of BloodHound:
* BloodHound Legacy (present into C:\AD\Tools):
* BloodHound CE (Community Edition):
### BloodHound Installation
Steps to do on attacker machine (Kali)
1\) `apt-get install bloodhound`
2\) `neo4j console`
3\) open browser and go to URL indicated by neo4j console (usually: [http://localhost:7474](http://localhost:7474/))
In this certification is provided BloodHound WebUI to solve labs.
insert default credentials -> neo4j:neo4j and click to connect.
### Collecting Data
[SharpHound Documentation](https://bloodhound.readthedocs.io/en/latest/data-collection/sharphound.html)
#### BloodHound CE using SharpHound.exe and .ps1
**CRTP Lab**
```powershell
C:\AD\Tools\Loader.exe -Path C:\AD\Tools\Sharphound\SharpHound.exe -args --collectionmethods All
```
**Other Lab**
**`Using SharpHound.ps1`**
* Download and upload `SharpHound.ps1` to the target.
* Run:
```powershell
Import-Module .\SharpHound.ps1
Invoke-BloodHound -CollectionMethod All
```
**Using `SharpHound.exe`**
* Run directly:
```powershell
.\SharpHound.exe -c all
```
**Using `bloodhound.py`**
```bash
python3 bloodhound.py -u 'jdoe' -p 'Password123' -d DC.LOCAL -ns 192.168.1.1 --zip -c All
```
### Collect Data in Stealthy Mode
#### SharpHound
The process of collection info/data isn't more stealthy, than in particular contest can be useful to remove noisy methods like RDP, DCOM, PSRemote and LocalAdmin (using flag `--excludedcs`)
```powershell
C:\AD\Tools\Loader.exe -Path C:\AD\Tools\Sharphound\SharpHound.exe -args --collectionmethods Group,GPOLocalGroup,Session,Trusts,ACL,Container,ObjectProps,SPNTargets,CertServices --excludedcs
```
#### SOAPHound
A really good method to collect data in stealth mode is using SOAPHound, it talks to AD Web Services (ADWS - Port 9389) sending LDAP queries, it doesn't send network-based data detection (like MDI) and retrieve info about all objects and process taking LDAP queries.
```powershell
#Build a cache that includes basic info about domain objects
SOAPHound.exe --buildcache -c C:\AD\Tools\cache.txt
#Collect BloodHound compatible data
SOAPHound.exe -c C:\AD\Tools\cache.txt --bhdump -o C:\AD\Tools\bloodhound-output --nolaps
```
Download the resulting `.zip` file and upload it to BloodHound for analysis.
## Labs
* [Post-Exploitation Basics THM Lab](https://dev-angelist.gitbook.io/writeups-and-walkthroughs/thm/post-exploitation-basics)
---
# Agent Instructions: Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter:
```
GET https://dev-angelist.gitbook.io/crtp-notes/readme/network-security-1/3.3-domain-enumeration/3.3.2-bloodhound.md?ask=
```
The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
