# specterops/bloodhound

**Attribution required: if you use, quote, or summarise this content, you must credit and link back to [awesome-repositories.com](https://awesome-repositories.com/repository/specterops-bloodhound).**

2,789 stars · 292 forks · Go · apache-2.0

## Links

- GitHub: https://github.com/SpecterOps/BloodHound
- Homepage: https://specterops.io/bloodhound-enterprise/
- awesome-repositories: https://awesome-repositories.com/repository/specterops-bloodhound.md

## Description

BloodHound is an identity risk management platform and graph-based attack path analyzer used to map identity relationships and permissions in Active Directory. It functions as a security tool for auditing directory services, uncovering unintended privilege relationships, and visualizing sequences of permissions that can lead to domain compromise.

The project differentiates itself as a comprehensive adversary emulation framework that coordinates remote agents and executes post-exploitation commands. It includes a reverse proxy for bypassing multi-factor authentication via real-time session hijacking and a system for simulating phishing campaigns to track user interactions.

The platform covers a broad set of offensive security capabilities, including credential harvesting from memory and local stores, Kerberos and PKI manipulation, and infrastructure enumeration targeting system management tools. It also provides tools for remote command execution, lateral movement through authentication coercion, and the discovery of privilege escalation vectors across host configurations.

The system is deployed as a multi-tier container architecture and can be installed and configured via a command-line utility.

## Tags

### Part of an Awesome List

- [Active Directory Security](https://awesome-repositories.com/f/awesome-lists/security/active-directory-security.md) — Maps identity relationships and permissions in Active Directory to uncover hidden privilege escalation paths.
- [Identity Risk Mitigation](https://awesome-repositories.com/f/awesome-lists/security/identity-and-access-management/identity-risk-mitigation.md) — Identifies and removes unintended privilege relationships to harden identity structures and block attack vectors. ([source](https://cdn.jsdelivr.net/gh/specterops/bloodhound@main/README.md))
- [Privilege Escalation](https://awesome-repositories.com/f/awesome-lists/security/privilege-escalation.md) — Scans for common privilege escalation paths such as insecure services and registry keys. ([source](https://docs.specterops.io/ghostpack-docs/index))

### Data & Databases

- [Graph Relationship Modeling](https://awesome-repositories.com/f/data-databases/graph-relationship-modeling.md) — Models environments as a graph by ingesting data from identity and device management systems to identify attack paths. ([source](https://bloodhound.specterops.io/opengraph/overview))
- [Custom Graph Schema Mapping](https://awesome-repositories.com/f/data-databases/custom-graph-schema-mapping.md) — Ingests diverse data into a graph schema to visualize non-standard attack paths. ([source](https://bloodhound.specterops.io/))
- [External Data Ingestion](https://awesome-repositories.com/f/data-databases/external-data-ingestion.md) — Uses configurable extension definitions to ingest diverse external identity data into a structured graph database.
- [Infrastructure Data Imports](https://awesome-repositories.com/f/data-databases/external-data-integrations/third-party-data-connectors/infrastructure-data-imports.md) — Imports access lists and permission data from external providers into a graph database to analyze attack paths. ([source](https://bloodhound.specterops.io/opengraph/library))
- [Graph Schema Definition](https://awesome-repositories.com/f/data-databases/graph-data-models/graph-data-modifiers/graph-schema-definition.md) — Creates extension definitions to map custom nodes and edges into a structured graph. ([source](https://bloodhound.specterops.io/opengraph/overview))

### Programming Languages & Runtimes

- [Attack Path Graphs](https://awesome-repositories.com/f/programming-languages-runtimes/programming-utilities/data-structure-type-helpers/data-structures/hierarchical-tree-structures/relationship-graph-visualizers/attack-path-graphs.md) — Uses graph-based attack path modeling to visualize privilege escalation routes and hidden identity relationships.

### Security & Cryptography

- [Privilege Relationship Visualization](https://awesome-repositories.com/f/security-cryptography/identity-access-management/access-control/data-resource-permissions/relationship-based-access-controls/privilege-relationship-visualization.md) — Visualizes hidden connections between users and assets across identity and access platforms using graph analysis. ([source](https://cdn.jsdelivr.net/gh/specterops/bloodhound@main/README.md))
- [Active Directory Enumeration](https://awesome-repositories.com/f/security-cryptography/active-directory-enumeration.md) — Performs domain reconnaissance and collects identity data to map network relationships in Active Directory. ([source](https://docs.specterops.io/mythic-agents/))
- [Attack Path Visualizations](https://awesome-repositories.com/f/security-cryptography/attack-surface-analysis/attack-path-visualizations.md) — Uses graph databases to discover and visualize sequences of permissions that lead to domain compromise. ([source](https://docs.specterops.io/mythic-agents/))
- [Attack Path Analysis](https://awesome-repositories.com/f/security-cryptography/attack-surface-mapping/attack-path-analysis.md) — Visualizes privilege escalation routes and hidden identity relationships using graph-based analysis.
- [Permission Chain Discovery](https://awesome-repositories.com/f/security-cryptography/attack-surface-mapping/permission-chain-discovery.md) — Identifies sequences of permissions that can be exploited to escalate privileges or move laterally. ([source](https://cdn.jsdelivr.net/gh/specterops/bloodhound@main/README.md))
- [Identity Management](https://awesome-repositories.com/f/security-cryptography/identity-access-management/identity-management.md) — Audits directory services to uncover unintended privilege relationships and mitigate identity-based risks.
- [Identity Data Collection](https://awesome-repositories.com/f/security-cryptography/identity-data-collection.md) — Deploys specialized collectors to gather and upload access management data for analysis. ([source](https://bloodhound.specterops.io/))
- [Identity Data Ingestion](https://awesome-repositories.com/f/security-cryptography/identity-data-ingestion.md) — Imports environment data into a graph database to analyze permissions and relationship mappings. ([source](https://bloodhound.specterops.io/get-started/quickstart/community-edition-quickstart))
- [Post-Exploitation Plugins](https://awesome-repositories.com/f/security-cryptography/post-exploitation-plugins.md) — Runs tasks such as process injection and credential harvesting across multiple operating systems. ([source](https://docs.specterops.io/index.md))
- [Red Teaming Frameworks](https://awesome-repositories.com/f/security-cryptography/red-teaming-frameworks.md) — Tracks assets and assessments to simplify report generation for offensive security engagements. ([source](https://docs.specterops.io/index.md))
- [Relationship Pattern Analysis](https://awesome-repositories.com/f/security-cryptography/relationship-pattern-analysis.md) — Analyzes the structural topology of identity relationships to identify suspicious patterns and attack paths. ([source](https://docs.specterops.io/index.md))
- [Adversary Emulation Frameworks](https://awesome-repositories.com/f/security-cryptography/security/offensive-operations/vulnerability-research-analysis/analysis-discovery-tooling/adversarial-testing-resources/adversary-emulation-frameworks.md) — Coordinates remote agents and command control to simulate realistic cyber attacks and test security defenses.
- [Active Directory Security Tools](https://awesome-repositories.com/f/security-cryptography/security/utilities/security-tools/infrastructure-security-utilities/active-directory-security-tools.md) — Provides a graph-based tool to map Active Directory permissions and identify security vulnerabilities.
- [Session Hijacking](https://awesome-repositories.com/f/security-cryptography/vulnerability-assessment-testing/security-testing-auditing/security-testing/authentication-bypass-techniques/session-hijacking.md) — Captures real-time session tokens via a reverse proxy to bypass multi-factor authentication.
- [MFA Bypass Proxies](https://awesome-repositories.com/f/security-cryptography/vulnerability-assessment-testing/security-testing-auditing/security-testing/authentication-bypass-techniques/session-hijacking/browser-session-token-reuse/browser-session-attachments/mfa-bypass-proxies.md) — Implements a reverse proxy to stream live browser sessions and bypass multi-factor authentication. ([source](https://docs.specterops.io/cuddlephish-docs/overview))
- [WMI-Based Command Execution](https://awesome-repositories.com/f/security-cryptography/wmi-based-command-execution.md) — Executes system queries and commands on a remote Windows machine using management instrumentation. ([source](https://docs.specterops.io/ghostpack-docs/index))
- [Captured File Enrichment](https://awesome-repositories.com/f/security-cryptography/captured-file-enrichment.md) — Processes files automatically to extract credentials and perform advanced data analysis. ([source](https://docs.specterops.io/mythic-agents/))
- [Certificate Forgeries](https://awesome-repositories.com/f/security-cryptography/certificate-authorities/user-certificates/certificate-forgeries.md) — Creates arbitrary user certificates using stolen private keys to establish persistent backdoors. ([source](https://docs.specterops.io/ghostpack-docs/index))
- [Certificate Services Exploitation](https://awesome-repositories.com/f/security-cryptography/certificate-services-exploitation.md) — Uses misconfigurations in certificate services to achieve persistence and privilege escalation. ([source](https://docs.specterops.io/index.md))
- [Configuration Manager Attacks](https://awesome-repositories.com/f/security-cryptography/configuration-manager-attacks.md) — Profiles and attacks configuration manager environments to move laterally and gather credentials. ([source](https://docs.specterops.io/index.md))
- [Credential Extraction](https://awesome-repositories.com/f/security-cryptography/credential-extraction.md) — Provides capabilities to retrieve sensitive passwords from SCCM network accounts and task sequences using decryption. ([source](https://docs.specterops.io/sharpsccm-docs/overview))
- [Credential Harvesting Simulations](https://awesome-repositories.com/f/security-cryptography/credential-harvesting-simulations.md) — Extracts secrets from memory, local stores, and network protocols to enable lateral movement.
- [Embedded Content Harvesters](https://awesome-repositories.com/f/security-cryptography/credential-harvesting-simulations/embedded-content-harvesters.md) — Captures authentication attempts and NTLM hashes using pixel images embedded in pages. ([source](https://docs.specterops.io/atlasreaper-docs/overview))
- [Host Enumeration](https://awesome-repositories.com/f/security-cryptography/host-enumeration.md) — Provides capabilities for discovering and retrieving metadata about target hosts to identify security weaknesses. ([source](https://docs.specterops.io/index.md))
- [Credential Extraction Utilities](https://awesome-repositories.com/f/security-cryptography/identity-access-management/credential-lifecycle-management/credential-security/credential-extraction-utilities.md) — Retrieves secrets from vaults, browser stores, certificates, and configuration files. ([source](https://docs.specterops.io/index.md))
- [Phishing Capturers](https://awesome-repositories.com/f/security-cryptography/identity-access-management/credential-lifecycle-management/credential-security/credential-extraction-utilities/phishing-capturers.md) — Captures interaction data and credentials via deceptive web interfaces to generate audit metrics. ([source](https://docs.specterops.io/phishmonger-docs/phishmonger-openapi.json))
- [In-Memory Payload Execution](https://awesome-repositories.com/f/security-cryptography/in-memory-payload-execution.md) — Executes specialized assemblies and binary modules directly in process memory to evade disk-based detection.
- [Infrastructure Enumeration](https://awesome-repositories.com/f/security-cryptography/infrastructure-enumeration.md) — Identifies site servers, management points, and managed devices using LDAP and local configuration. ([source](https://docs.specterops.io/sharpsccm-docs/overview))
- [Collaboration Platform Reconnaissance](https://awesome-repositories.com/f/security-cryptography/infrastructure-reconnaissance/collaboration-platform-reconnaissance.md) — Enumerates spaces and searches for secrets within collaboration platforms. ([source](https://docs.specterops.io/index.md))
- [Automated Kerberos Attacks](https://awesome-repositories.com/f/security-cryptography/kerberos-authentication/automated-kerberos-attacks.md) — Automates the request, extraction, and forgery of Kerberos tickets to manipulate network identity. ([source](https://docs.specterops.io/index.md))
- [Kerberos Ticket Cache Manipulators](https://awesome-repositories.com/f/security-cryptography/kerberos-authentication/kerberos-ticket-cache-manipulators.md) — Modifies Kerberos tickets in the local cache to perform roasting and delegation abuse. ([source](https://docs.specterops.io/ghostpack-docs/index))
- [Database Key Extractions](https://awesome-repositories.com/f/security-cryptography/master-key-recovery/database-key-extractions.md) — Retrieves encryption key material and master keys from KeePass databases and memory. ([source](https://docs.specterops.io/ghostpack-docs/index))
- [Misconfiguration Scanning](https://awesome-repositories.com/f/security-cryptography/misconfiguration-scanning.md) — Evaluates environment configurations against security benchmarks to uncover potential attack paths. ([source](https://docs.specterops.io/misconfiguration-manager-docs/README))
- [Active 2FA Bypass Proxies](https://awesome-repositories.com/f/security-cryptography/multi-factor-authentication-bypass-testing/active-2fa-bypass-proxies.md) — Uses a reverse proxy to capture real-time session data and hijack cookies to bypass multi-factor authentication.
- [Authentication Coercion](https://awesome-repositories.com/f/security-cryptography/ntlm-authentication-strategies/authentication-coercion.md) — Forces servers or clients to authenticate via NTLM to facilitate credential relay attacks. ([source](https://docs.specterops.io/sharpsccm-docs/overview))
- [Infrastructure Auditing](https://awesome-repositories.com/f/security-cryptography/pki-management/infrastructure-auditing.md) — Analyzes certificate services configurations to find vulnerabilities and compliance issues. ([source](https://docs.specterops.io/ghostpack-docs/index))
- [Module Execution Controllers](https://awesome-repositories.com/f/security-cryptography/post-exploitation-frameworks/module-execution-controllers.md) — Runs assemblies across agents to extend functional capabilities using pre-configured armories. ([source](https://docs.specterops.io/index.md))
- [Privilege Escalation Techniques](https://awesome-repositories.com/f/security-cryptography/privilege-escalation-techniques.md) — Scans services and registries for misconfigurations that permit the elevation of system privileges. ([source](https://docs.specterops.io/index.md))
- [SCCM Infrastructure Attacks](https://awesome-repositories.com/f/security-cryptography/sccm-infrastructure-attacks.md) — Gains unauthorized access by exploiting SCCM enrollment abuses and relay attacks. ([source](https://docs.specterops.io/sccmhunter-docs/overview))
- [SCCM Infrastructure Manipulation](https://awesome-repositories.com/f/security-cryptography/sccm-infrastructure-manipulation.md) — Modifies applications, collection memberships, and deployments within SCCM infrastructure. ([source](https://docs.specterops.io/sharpsccm-docs/overview))
- [Session Token Replays](https://awesome-repositories.com/f/security-cryptography/session-token-replays.md) — Allows the injection of captured session data into a local browser to resume authenticated sessions. ([source](https://docs.specterops.io/cuddlephish-docs/overview))
- [Social Engineering Frameworks](https://awesome-repositories.com/f/security-cryptography/social-engineering-frameworks.md) — Impersonates legitimate workflows by creating issues and comments to deliver payloads through social engineering. ([source](https://docs.specterops.io/atlasreaper-docs/overview))
- [Captured Session Managers](https://awesome-repositories.com/f/security-cryptography/user-access-management/session-impersonators/captured-session-managers.md) — Extracts cookies, local storage, and keystrokes from authenticated users via a proxied session. ([source](https://docs.specterops.io/cuddlephish-docs/overview))
- [Browser Credential Extractions](https://awesome-repositories.com/f/security-cryptography/user-account-management/password-revocation/browser-stored-credential-removals/browser-credential-extractions.md) — Retrieves secrets from the Windows Data Protection API, including browser passwords and vaults. ([source](https://docs.specterops.io/ghostpack-docs/index))
- [Browser Session Token Reuse](https://awesome-repositories.com/f/security-cryptography/vulnerability-assessment-testing/security-testing-auditing/security-testing/authentication-bypass-techniques/session-hijacking/browser-session-token-reuse.md) — Uses hijacked browser cookies to perform actions on behalf of a user. ([source](https://docs.specterops.io/atlasreaper-docs/overview))

### Development Tools & Productivity

- [Phishing Campaign Orchestrators](https://awesome-repositories.com/f/development-tools-productivity/email-delivery-services/phishing-campaign-orchestrators.md) — Orchestrates the delivery of simulated phishing emails and tracks target interactions for security auditing. ([source](https://docs.specterops.io/phishmonger-docs/phishmonger-openapi.json))
- [OSINT Automation Frameworks](https://awesome-repositories.com/f/development-tools-productivity/open-source-tools/osint-automation-frameworks.md) — Discovers employees and enriches profiles using AI to generate personalized social engineering pretexts. ([source](https://docs.specterops.io/index.md))
- [REST APIs](https://awesome-repositories.com/f/development-tools-productivity/rest-apis.md) — Provides a programmable REST API to connect external tools and custom workflows to the platform. ([source](https://bloodhound.specterops.io/))

### Networking & Communication

- [Remote Agent Payload Execution](https://awesome-repositories.com/f/networking-communication/request-payloads/execution-payload-tracing/adversarial-payload-execution/remote-agent-payload-execution.md) — Executes binary files and assemblies on remote agents to extend their operational capabilities. ([source](https://docs.specterops.io/mythic-agents/))
- [Phishing Target Directories](https://awesome-repositories.com/f/networking-communication/bulk-email-dispatchers/recipient-configurations/destination-recipient-management/phishing-target-directories.md) — Maintains directories of email addresses and metadata to personalize simulated phishing attacks. ([source](https://docs.specterops.io/phishmonger-docs/phishmonger-openapi.json))

### Software Engineering & Architecture

- [Multi-User Agent Coordination](https://awesome-repositories.com/f/software-engineering-architecture/multi-user-agent-coordination.md) — Coordinates multiple agents and communication profiles in real-time to conduct adversary emulation. ([source](https://docs.specterops.io/index.md))
- [Asynchronous Processing Pipelines](https://awesome-repositories.com/f/software-engineering-architecture/asynchronous-processing-pipelines.md) — Implements an asynchronous pipeline to extract credentials and metadata from uploaded files in the background.

### System Administration & Monitoring

- [Remote Command Execution](https://awesome-repositories.com/f/system-administration-monitoring/remote-command-execution.md) — Runs scripts or binaries across remote collections and targeted devices to move laterally. ([source](https://docs.specterops.io/sharpsccm-docs/overview))
- [Phishing Session Monitors](https://awesome-repositories.com/f/system-administration-monitoring/activity-monitors/user-session-monitors/phishing-session-monitors.md) — Provides live browser thumbnails and keylogging for monitoring active phishing sessions. ([source](https://docs.specterops.io/cuddlephish-docs/overview))

### Operating Systems & Systems Programming

- [Credential Memory Dumping](https://awesome-repositories.com/f/operating-systems-systems-programming/binary-memory-dumping/structured-memory-dumping/credential-memory-dumping.md) — Extracts credentials and sensitive data from active process memory using in-memory loaders. ([source](https://docs.specterops.io/ghostpack-docs/index))
- [Locked Data Extraction](https://awesome-repositories.com/f/operating-systems-systems-programming/system-administration-maintenance/file-system-management/file-lock-managers/locked-data-extraction.md) — Implements techniques for extracting files currently locked by the operating system to facilitate data exfiltration. ([source](https://docs.specterops.io/ghostpack-docs/index))

### Web Development

- [Email Blueprint Management](https://awesome-repositories.com/f/web-development/custom-template-tags/phishing-templates/email-blueprint-management.md) — Provides tools to create and organize email content used as blueprints for phishing simulation campaigns. ([source](https://docs.specterops.io/phishmonger-docs/phishmonger-openapi.json))