root@thehacksparrow:~/writeups$ SYSTEM ONLINE
· log in sign up
← back to cheatsheets
root@sparrow:~/writeups$ cat bloodhound.md
// Active Directory

BloodHound

21 Jul 2026 · 6 min read
Active Directorycheatsheetsbloodhound
BloodHound is an Active Directory analysis tool that maps users, groups, computers, and permissions as a graph. Its value lies in surfacing hidden relationships that open privilege escalation paths up to Domain Admin. Data is collected with SharpHound (Windows) or bloodhound-python (Linux) and loaded into a Neo4j database.

What really matters isn't collecting data but understanding that BloodHound models AD as directed relationships: each edge (MemberOf, AdminTo, HasSession…) is a concrete attack step. The collectors (-c All, DCOnly, Session) determine which edges you obtain and how much noise you generate, and Cypher queries let you interrogate the graph beyond the predefined paths.

1. Beginner level — collection with SharpHound

BLOODHOUND cheat sheet — Beginner
CommandWhat it does
bloodhound-python -u u -p p -d dom -c AllCollects full domain data
SharpHound.exe -c AllCollects full data (from Windows)
bloodhound-python -u u -p p -d dom -c DCOnlyCollects only from the DC (stealthier)
bloodhound-python -u u -p p -d dom -ns <ip>Specifies the DNS/DC server to use
SharpHound.exe -c Group,LocalAdminCollects only groups and local admins
bloodhound-python -u u -p p -d dom -c SessionCollects only active sessions
neo4j startStarts the Neo4j database
bloodhoundLaunches the BloodHound graphical interface
bloodhound-python -u u -p p -d dom --zipCompresses the results into a ZIP
SharpHound.exe -c All --zipfilename out.zipNames the output ZIP file
bloodhound-python -u u -p p -d dom -c All -vVerbose mode
bloodhound-python --hashes LM:NT u@dom -c AllAuthenticates using an NTLM hash
SharpHound.exe --helpShows SharpHound help
bloodhound-python -u u -p p -d dom --dns-tcpForces DNS resolution over TCP

2. Advanced level — stealth and Cypher queries

BLOODHOUND cheat sheet — Advanced
CommandWhat it does
SharpHound.exe -c All --StealthCollection in stealth mode (less noise)
SharpHound.exe -c All --ExcludeDCsExcludes the DCs from collection
bloodhound-python -c All --disable-autogcDisables the automatic garbage collector
bloodhound-python -u u -p p -d dom -c LoggedOnCollects logged-on users
SharpHound.exe -c All -d otro.localCollects against a trusted domain
bloodhound-python -u u -p p -d dom --kerberosAuthenticates using Kerberos instead of NTLM
MATCH p=shortestPath((u:User)-[*]->(d:Domain)) RETURN pCypher: shortest path to Domain Admin
MATCH (u:User {owned:true}) RETURN uCypher: lists the nodes marked "owned"
MATCH (n) WHERE n.admincount=true RETURN nCypher: users with AdminCount enabled
SharpHound.exe -c All --LdapUsername u --LdapPassword pCollects with alternate LDAP credentials
bloodhound-python -u u -p p -d dom -c ObjectPropsCollects extended object properties
SharpHound.exe -c All --SearchForestExtends collection to the whole AD forest
bloodhound-python -u u -p p -d dom --throttle 1000Adds delay between requests (ms)
SharpHound.exe -c All --CacheFilename cache.binSets a custom cache file

3. Details people miss

  • BloodHound needs a running Neo4j database before loading data: start neo4j start and confirm it answers on bolt://localhost:7687 before launching the GUI.
  • The -c All collector is the most complete but also the noisiest: in monitored environments use DCOnly or --Stealth to cut down requests and host connections.
  • bloodhound-python relies on correct DNS resolution toward the DC; if it fails, use -ns <ip> to pin the DNS server or --dns-tcp when UDP is blocked.
  • Watch version compatibility: the SharpHound data format must match the BloodHound version importing the ZIP, or ingestion will fail silently.
  • Mark the nodes you already control as owned in the interface: many attack-path queries (and Cypher ones using owned:true) build on that state to compute realistic paths.

Responsible use

These commands are for systems you own or have explicit written authorisation to test (labs, CTFs, contracted engagements). Using them against third-party infrastructure without permission is illegal in most countries.