AD Attack Path Analysis with BloodHound

Deploy BloodHound CE and analyze Active Directory attack paths.

Introduction

30 Second Summary

Active Directory is the backbone of most corporate networks. When attackers find a way in, they chain together small misconfigurations to escalate from a regular user all the way to Domain Admin.

In this project, you will deploy BloodHound Community Edition on your Kali Linux VM, ingest official multi-domain sample data, identify critical privilege escalation paths, and publish a professional pentest findings report to GitHub.

What You'll Build

A professional Active Directory attack path analysis project with a pentest-style report, a hands-on challenge for others to attempt, and a public GitHub repository packaging everything together.

By the end of this project, you'll have:

  • A working BloodHound CE instance running on Kali Linux with multi-domain sample data ingested and critical attack paths identified.
  • A professional pentest findings report (REPORT.md) with severity ratings, attack path evidence, and remediation recommendations.
  • A reproducible challenge and solution (CHALLENGE.md and SOLUTION.md) that anyone can attempt against the same dataset.
  • Secret Mission: Write custom Cypher queries to discover non-obvious attack paths and cross-domain trust abuse chains.

Are there any prerequisites?

You should be familiar with Active Directory concepts (domains, groups, trusts, Kerberos) and have basic Linux command line experience. You also need a Kali Linux VM running in VirtualBox on a host with at least 16GB RAM, and a GitHub account.

Install Docker and Deploy BloodHound CE

BloodHound CE needs a container runtime to manage its database, API, and UI layers. Docker handles all of this through a single CLI tool that pulls and orchestrates the required containers automatically.

In this step, you will increase your VirtualBox VM's RAM to meet BloodHound's requirements, install Docker on Kali, then deploy BloodHound CE using the official bloodhound-cli tool.

In this step, get ready to:
  • Allocate 8GB RAM to your Kali VM and install Docker.
  • Download and deploy BloodHound CE using the official CLI tool.
  • Access the BloodHound CE interface and confirm it is working.
Allocate 8GB RAM to your Kali VM and install Docker

BloodHound CE requires a minimum of 8GB of RAM and 4 processor cores to run smoothly. Your Kali VM needs its memory allocation increased before you install anything.

  • Shut down your Kali VM completely.
  • In VirtualBox, select your Kali machine and click Settings.
  • Navigate to System, then the Motherboard tab.
  • Set Base Memory to 8192 MB.
  • Click OK to save, then boot the VM.

Why 8GB RAM?

BloodHound CE runs multiple containers (a graph database, an API server, and a web UI). The graph database is memory-intensive, especially when computing shortest paths across large datasets. With less than 8GB, containers can terminate unexpectedly with exit code 137 (out of memory).

Once your VM is booted and you are logged in, open a terminal. You will use it for the rest of this step.

  • Update your package lists and install Docker by running this command:
sudo apt update && sudo apt install -y docker.io

Why docker.io and not docker?

Kali already has a package named docker that is a system tray utility, not the container runtime. The docker.io package is Kali's official Docker container runtime package.

  • Enable and start the Docker service by running:
sudo systemctl enable docker --now
  • Add your user to the docker group so you can run Docker commands without sudo:
sudo usermod -aG docker $USER
  • Log out of your Kali session and log back in for the group change to take effect.
  • Open a new terminal and verify Docker is working by running:
docker info

✔️ I see Server Version and container details

Docker is installed and running correctly. You should see output including a Server Version line, container counts, and storage driver information. You are ready to move on.

ⓧ I see "permission denied"

The group change has not taken effect yet. Make sure you fully logged out and back in (not just closed the terminal). You can also try rebooting the VM.

  • Reboot your Kali VM.
  • Open a new terminal and run docker info again.

ⓧ I see "command not found" or the service is not running

Docker may not have installed correctly or the service failed to start.

  • Check if the package installed by running:
dpkg -l | grep docker.io

If nothing appears, re-run the install command. If the package is listed, try starting the service manually:

sudo systemctl start docker

Then run docker info again.

Download and run BloodHound CLI

The bloodhound-cli is the officially recommended way to deploy BloodHound CE. It generates the Docker Compose configuration and pulls all required container images automatically.

  • Download the BloodHound CLI binary by running:
wget https://github.com/SpecterOps/bloodhound-cli/releases/latest/download/bloodhound-cli-linux-amd64.tar.gz
  • Unpack the archive by running:
tar -xvzf bloodhound-cli-linux-amd64.tar.gz
  • Install BloodHound CE by running:
./bloodhound-cli install

What happens during install?

This command pulls several Docker images (a PostgreSQL database, a Neo4j graph database, and the BloodHound application layer). It may take a few minutes depending on your internet speed.

Keep the terminal open until you see the confirmation message with a generated admin password. Do not close the terminal early.

When the install finishes, you should see output like this:

[+] BloodHound is ready to go!
[+] You can log in as `admin` with this password: <Password>
  • Copy and save the generated password somewhere safe. You will need it in the next substep.

Don't see the password?

If the output completed but no password appeared, re-run the same install command:

./bloodhound-cli install

This will display the generated password again. If the process seems stuck or a container exited unexpectedly, make sure your VM has the full 8GB RAM allocated and try again.

Help me troubleshoot BloodHound CLI install not showing a password.

Access BloodHound CE and verify

BloodHound CE serves its web interface on port 8080. You will log in, reset the default password, and confirm the interface loads correctly.

  • Open Firefox in your Kali VM.
  • Navigate to http://localhost:8080/ui/login.
  • Enter admin as the username.
  • Paste the generated password from the previous substep into the password field.
  • Click Login.
  • When prompted, set a new password. Choose something memorable and save it securely.
  • Confirm you see the BloodHound CE main interface with the left sidebar menu.

Can't reach the login page?

Make sure the containers are actually running. Open a terminal and run docker ps to check. You should see multiple containers with names containing bloodhound.

If containers show as restarting or exited, your VM may not have enough memory. Verify the 8192 MB allocation in VirtualBox settings and restart the VM.

Help me fix BloodHound CE not loading in my browser.

Your environment is ready. BloodHound CE is running and waiting for data. Next up, you will ingest a multi-domain Active Directory dataset and start hunting for attack paths.

Ingest Sample Data and Identify Attack Paths

In the previous step, you deployed BloodHound CE on your Kali VM. Now it's time to feed it data and discover how an attacker could move through a real Active Directory environment.

BloodHound works by mapping relationships between AD objects (users, groups, computers, trusts) as a graph. Once data is loaded, you can ask questions like "what is the shortest path from this user to Domain Admin?" and BloodHound will calculate the answer in seconds. You will load the official SpecterOps multi-domain sample dataset, then use the graph to uncover critical privilege escalation paths.

In this step, get ready to:
  • Upload the official SpecterOps AD sample dataset into BloodHound CE.
  • Find shortest paths to Domain Admin across three domains.
  • Investigate Kerberoasting, ACL abuse, ADCS misconfigurations, and DCSync exposure.
Download and upload the AD sample dataset

BloodHound CE provides an official sample dataset generated with SharpHound. It includes 3 collected domains with trust relationships, local permissions coverage, and multiple ADCS escalation paths. This gives you a realistic multi-domain environment to analyse without needing to stand up an AD lab.

  • Create a folder to store your screenshots by running this command in a terminal:
  • Create a folder to store your screenshots by running this command in a terminal:
  • Create a folder to store your screenshots by running this command:
mkdir -p ~/bloodhound-project/screenshots

What does this command do?

The -p flag creates both bloodhound-project and screenshots in one go, without erroring if the parent folder already exists. You will save all your attack path screenshots here for your report later.

  • Switch to Firefox where BloodHound CE is open.
  • In the left menu, click Quick Upload.
  • You need the sample data ZIP file. Open a new tab in Firefox and navigate to the BloodHound CE sample data documentation page:
https://bloodhound.specterops.io/get-started/quickstart/ce-ingest-sample-data
  • Under the Active Directory heading, click the download link to save the sample data ZIP file.
  • Switch back to the BloodHound CE tab with Quick Upload open.
  • Drag and drop the downloaded sample data ZIP file into the upload modal.
  • Click Upload to begin the data ingest process.
  • Wait for ingestion to complete. This typically takes 30-60 seconds.

Once ingestion finishes, BloodHound has mapped all the users, computers, groups, trusts, and permissions from the three sample domains into a queryable graph.

What does the sample data include?

The dataset contains 3 collected domains with trusts between them, additional visible trusted domains without collections, coverage for local permissions, and multiple ADCS escalation paths. This is the same data structure a real SharpHound collection would produce from a live environment.

Upload stuck or failing?

Make sure you uploaded the ZIP file itself, not an extracted folder. BloodHound accepts .zip archives directly.

If the upload appears to hang, wait 2-3 minutes. On lower-memory systems the initial graph database write can take time. If the BloodHound container crashes (exit code 137), your VM may need more RAM.

Help me troubleshoot BloodHound CE data upload issues

Find shortest paths to Domain Admin

The most critical question in any AD assessment is: who can reach Domain Admin? BloodHound's graph theory-based approach answers this by computing the shortest path between any two nodes.

  • In BloodHound CE, click Explore in the left menu to open the graph exploration view.
  • Click the Cypher tab to access the query interface.
  • Look for the pre-built "Shortest Paths to Domain Admins" query in the saved queries list and run it.
  • Select each Domain Admins group across the three domains to view paths targeting each one.

What is Cypher?

Cypher is a graph query language designed for pattern matching in graph databases. BloodHound uses it to traverse relationships between AD objects. A query like MATCH p=shortestPath((n)-[*1..]->(m:Group)) finds the shortest chain of relationships from one node to a target group.

  • Now use the Pathfinding tab to trace a specific path.
  • In the search bar, type user:bob to find the user BOB@PHANTOM.CORP.
  • Set BOB@PHANTOM.CORP as the start node and ADMINISTRATORS@PHANTOM.CORP as the target.
  • Run the pathfinding query to see the full attack path.

The graph displays each hop in the path, showing the edge types (relationships) between nodes. This tells you exactly what an attacker would exploit at each step.

  • For each path you discover, document the following in a text file or notes: the starting principal, each hop, the edge type at each hop, and what an attacker would do at that step.
  • Take a screenshot of the shortest path graph by pressing the Print Screen key on your keyboard.
  • Save the screenshot to ~/bloodhound-project/screenshots/ with a descriptive name like shortest-path-da.png.

Use descriptive filenames

Name each screenshot after the attack path it shows (e.g., bob-to-da-phantom.png). You will reference these filenames in your report later.

No paths showing up?

If the Pathfinding tab returns no results, double-check that the sample data uploaded successfully. Navigate to the search bar and type user:bob. If no results appear, the data has not been ingested correctly. Try re-uploading the ZIP file via Quick Upload.

Help me troubleshoot missing paths in BloodHound CE

Investigate Kerberoasting, ACL abuse, and ADCS

Beyond the obvious shortest path to Domain Admin, real environments expose multiple categories of vulnerability. You will now hunt for Kerberoasting targets, dangerous ACL edges, ADCS misconfigurations, and hidden DCSync privileges.

Each of these represents a distinct class of privilege escalation that security teams must identify during a penetration test.

  • In the Explore view, use the search bar to find Kerberoastable accounts. Look for users with Service Principal Names (SPNs) set.
  • For each Kerberoastable account, check if it has a path to Domain Admin using the Pathfinding tab.
  • Take a screenshot of any Kerberoastable account that has a DA path. Save it to ~/bloodhound-project/screenshots/.

What is Kerberoasting?

Kerberoasting is an attack where any authenticated domain user requests a Kerberos service ticket for an account with an SPN. The ticket is encrypted with the account's password hash. An attacker can crack this offline to recover the plaintext password.

If that account has a path to Domain Admin, a single cracked password gives the attacker full domain control.

  • Now identify dangerous ACL edges on high-value targets. Search for edges of type GenericAll, GenericWrite, WriteDACL, ForceChangePassword, and WriteOwner that point to Domain Admin members or high-privilege groups.
  • Trace at least one full ACL abuse chain showing multiple hops. For example, a user with GenericAll on a group, whose members have WriteDACL on a Domain Admin.
  • Take a screenshot of the ACL abuse chain.

Why are ACL edges dangerous?

Access Control Lists define who can do what to AD objects. Edges like GenericAll grant full control, WriteDACL lets an attacker modify permissions, and ForceChangePassword allows resetting a user's password without knowing the current one.

These are often overlooked in security reviews because they require graph analysis to spot the transitive chains.

  • Identify ADCS escalation paths. The sample data includes multiple ESC-style certificate template misconfigurations that allow privilege escalation.
  • Look for ADCS-related pre-built queries in the saved queries panel. Run them to visualise certificate-based attack paths.
  • Take a screenshot of at least one ADCS escalation path.
  • Finally, identify DCSync-capable principals who are NOT in the Domain Admins group. These are users or groups with GetChanges and GetChangesAll privileges on the domain object.
  • Take a screenshot showing DCSync-capable non-DA principals.

Why is DCSync without Domain Admin dangerous?

DCSync lets an account replicate all password hashes from the domain controller. If this privilege belongs to a non-Domain Admin account, it represents a hidden escalation path that defenders often miss.

Finding these accounts is a critical finding in any AD assessment.

  • Confirm your screenshots are saved by running:
ls ~/bloodhound-project/screenshots/

You should see multiple PNG files with descriptive names covering each attack path category: shortest path to DA, Kerberoastable accounts, ACL abuse chains, ADCS escalation, and DCSync exposure.

Screenshots not saving to the right folder?

By default, Kali saves screenshots to ~/Pictures/Screenshots/ or the current working directory. After taking a screenshot with Print Screen, move or copy it to ~/bloodhound-project/screenshots/ using the file manager or a mv command in the terminal.

Help me save screenshots to a specific folder on Kali

You have now mapped the critical attack surface of a multi-domain AD environment. Next up, you will turn these findings into a professional pentest report with severity ratings and remediation guidance.

Write the Findings Report

You have identified critical attack paths across the sample dataset. You know how attackers could reach Domain Admin, which accounts are Kerberoastable, and where ACL misconfigurations create hidden escalation routes.

Now it is time to turn those findings into a professional deliverable. In this step, you will create a structured project directory, write a pentest-style findings report, and save your Cypher queries as reusable files that anyone can run against the same dataset.

In this step, get ready to:
  • Create the project file structure with report, challenge, and solution stubs.
  • Write a professional findings report with severity ratings and remediation.
  • Save your Cypher queries as documented, reusable files.
Create the project file structure

A well-organised directory structure makes your project easy to navigate for anyone reviewing it. You will create folders for screenshots and queries, plus the markdown files that form your deliverables.

  • Switch back to the terminal in your Kali VM.
  • Create the project subdirectories and files by running these commands:
mkdir -p ~/bloodhound-project/{screenshots,queries}
cd ~/bloodhound-project
touch README.md REPORT.md CHALLENGE.md SOLUTION.md

What do these commands do?

The mkdir -p command creates the queries/ subdirectory inside your project folder. The -p flag means it will not error if a directory already exists (like screenshots/ which you created earlier).

The touch command creates empty files for your report, challenge, solution, and README. You will fill these in throughout this step and the next.

  • Confirm the files exist by running:
ls

You should see CHALLENGE.md, README.md, REPORT.md, SOLUTION.md, queries, and screenshots in the output.

Missing files or directories?

Make sure you ran the commands from inside ~/bloodhound-project/. If you see an empty listing, check that cd ~/bloodhound-project ran successfully before touch.

help me figure out why my project files are missing

Write REPORT.md

A professional pentest report communicates risk to stakeholders who may not be technical. Each finding needs a clear severity rating, a step-by-step attack narrative, and concrete remediation advice.

  • Open REPORT.md in a text editor. You can use nano directly in the terminal:
nano ~/bloodhound-project/REPORT.md
  • Structure your report using the following template. Copy it into the file and fill in each section with the specific findings from your analysis in Step 2:
# Active Directory Attack Path Analysis - Findings Report

## Executive Summary

<!-- 2-3 sentences summarising the most critical risks found -->
<!-- Example: Analysis of the multi-domain environment identified X critical
     privilege escalation paths that would allow a low-privileged attacker
     to achieve Domain Admin access. -->

## Scope and Methodology

- **Tool:** BloodHound Community Edition
- **Data Source:** SpecterOps official AD sample dataset (3 domains)
- **Methodology:** Graph-based attack path analysis using shortest-path
  algorithms, ACL enumeration, Kerberoasting checks, and ADCS review

## Environment Overview

- **Domains:** 3 collected domains with trust relationships
- **Trust Types:** Document the trust relationships you observed
- **Coverage:** Local permissions, ADCS escalation paths, group memberships

## Findings

### Finding 1: Shortest Path to Domain Admin

| Field       | Detail                          |
|-------------|---------------------------------|
| Severity    | Critical                        |
| Description | A low-privileged user can reach Domain Admin in N hops |

**Attack Path:**
1. Starting principal: USER@DOMAIN
2. Hop 1: Edge type - description of what attacker does
3. Hop 2: Edge type - description of what attacker does
4. Result: Domain Admin access achieved

**Impact:** Full domain compromise including access to all domain resources.

**Evidence:** See screenshots/shortest-path-da.png

**Remediation:**
- Remove unnecessary group memberships along the path
- Implement tiered administration model
- Review delegation permissions on intermediate objects

### Finding 2: Kerberoastable Account with Path to DA

| Field       | Detail                          |
|-------------|---------------------------------|
| Severity    | High                            |
| Description | A service account with an SPN has a path to DA |

**Attack Path:**
1. Request TGS ticket for Kerberoastable account
2. Crack service ticket offline to recover password
3. Use compromised account to traverse path to DA

**Impact:** Offline credential attack leads to domain compromise.

**Evidence:** See screenshots/kerberoastable-da-path.png

**Remediation:**
- Use Group Managed Service Accounts (gMSA) instead of standard accounts
- Enforce 25+ character passwords on service accounts
- Remove unnecessary privileges from service accounts

### Finding 3: ACL Abuse Chain

| Field       | Detail                          |
|-------------|---------------------------------|
| Severity    | High                            |
| Description | Chained ACL permissions allow privilege escalation |

**Attack Path:**
1. User has GenericWrite on intermediate object
2. Modify object to gain WriteDACL on next target
3. Grant self GenericAll on high-value group
4. Add self to privileged group

**Impact:** Non-obvious escalation path bypasses standard monitoring.

**Evidence:** See screenshots/acl-abuse-chain.png

**Remediation:**
- Audit ACLs on sensitive objects using BloodHound
- Remove GenericAll and WriteDACL from non-admin principals
- Implement ACL monitoring alerts on Tier Zero objects

### Finding 4: ADCS Misconfiguration

| Field       | Detail                          |
|-------------|---------------------------------|
| Severity    | Critical                        |
| Description | Certificate template misconfiguration enables escalation |

**Attack Path:**
1. Identify vulnerable certificate template (ESC type)
2. Enroll certificate with attacker-controlled subject
3. Use certificate to authenticate as privileged principal

**Impact:** Any authenticated user can escalate to Domain Admin via ADCS.

**Evidence:** See screenshots/adcs-escalation.png

**Remediation:**
- Remove enrollment permissions for low-privileged users on sensitive templates
- Disable unnecessary certificate templates
- Enable CA certificate manager approval for sensitive templates
- Audit templates for ENROLLEE_SUPPLIES_SUBJECT flag

## Recommendations

### Quick Wins (implement immediately)
1. Remove Kerberoastable SPNs from accounts that do not need them
2. Reset passwords on all identified Kerberoastable accounts
3. Remove GenericAll/WriteDACL permissions from non-admin principals

### Medium-Term (1-3 months)
1. Implement tiered administration model
2. Migrate service accounts to Group Managed Service Accounts
3. Audit and harden ADCS certificate templates

### Long-Term (3-6 months)
1. Deploy BloodHound for continuous attack path monitoring
2. Implement Privileged Access Workstations (PAWs)
3. Establish regular ACL reviews on Tier Zero objects

What makes this report professional?

Each finding follows a consistent structure: severity, description, attack path narrative, impact, evidence, and remediation. This format mirrors what security consultancies deliver to clients.

The Recommendations section prioritises actions by implementation effort. Quick wins address the highest risk with the least work. This helps decision-makers act immediately on what matters most.

  • Replace the placeholder comments and example text with your actual findings from Step 2. Reference the specific users, groups, and edge types you discovered in the sample data.
  • Save REPORT.md when you are done. In nano, press Ctrl+O to write the file, then Ctrl+X to exit.

Use your screenshots as evidence

Reference the screenshot filenames you saved in ~/bloodhound-project/screenshots/ during Step 2. Each finding should point to a specific screenshot that proves the attack path exists.

Save your Cypher queries as reusable files

Saving queries as individual files with comments makes them reusable. Anyone who clones your repo can run these queries against the same dataset to reproduce your findings.

  • Create the shortest path to Domain Admins query file by running:
cat > ~/bloodhound-project/queries/shortest-path-da.cypher << 'EOF'
// Find shortest paths from any user to Domain Admins
// This is the most fundamental attack path query - it reveals
// how many hops separate standard users from full domain compromise.
// Cypher is case-sensitive: group names use UPPERCASE@DOMAIN format.

MATCH p=shortestPath((n:User)-[*1..]->(m:Group))
WHERE m.name STARTS WITH "DOMAIN ADMINS@"
RETURN p
EOF

What does this query do?

The shortestPath function finds the minimum number of hops between any User node and the Domain Admins group. Using STARTS WITH instead of an exact domain name means this query works across all three domains in the dataset.

The [*1..] syntax means "follow any relationship type, one or more hops, with no upper limit." This lets BloodHound traverse MemberOf, GenericAll, WriteDACL, and any other edge that creates a path.

  • Create the Kerberoastable accounts query file by running:
cat > ~/bloodhound-project/queries/kerberoastable-with-da-path.cypher << 'EOF'
// Find Kerberoastable users who have a path to Domain Admins
// These accounts have SPNs set, making them vulnerable to offline
// password cracking. If they also have a path to DA, cracking their
// password gives an attacker a route to full domain compromise.

MATCH (u:User {hasspn: true})
MATCH p=shortestPath((u)-[*1..]->(g:Group))
WHERE g.name STARTS WITH "DOMAIN ADMINS@"
RETURN u.name, length(p) AS hops, p
ORDER BY hops ASC
EOF

What does this query do?

The first MATCH finds all users where hasspn is true. These are Kerberoastable accounts whose service tickets an attacker can request and crack offline.

The second MATCH chains a shortest-path query from each Kerberoastable user to Domain Admins. The ORDER BY hops ASC sorts results so the most dangerous accounts (fewest hops) appear first.

  • Create the ACL abuse chain query file by running:
cat > ~/bloodhound-project/queries/acl-abuse-chain.cypher << 'EOF'
// Find ACL abuse chains leading to Domain Admins
// Restricts traversal to ACL-based edges only: GenericAll, GenericWrite,
// WriteDacl, WriteOwner, ForceChangePassword, and Owns.
// These edges represent permissions that can be directly abused
// without needing credentials or network access.

MATCH p=shortestPath((n:User)-[:GenericAll|GenericWrite|WriteDacl|WriteOwner|ForceChangePassword|Owns*1..]->(m:Group))
WHERE m.name STARTS WITH "DOMAIN ADMINS@"
RETURN p
EOF

What does this query do?

By specifying edge types with the pipe | separator, this query only follows ACL-based relationships. It ignores group memberships and session data, isolating paths that rely purely on misconfigured permissions.

These are often the most dangerous paths because an attacker can exploit them without ever needing a password. A single GenericAll permission on the right object can grant full control over that object.

  • Create the DCSync non-Domain Admin query file by running:
cat > ~/bloodhound-project/queries/dcsync-non-da.cypher << 'EOF'
// Find principals with DCSync rights who are NOT Domain Admins
// DCSync allows replicating password hashes from the domain controller.
// Principals with this right who are not in Domain Admins represent
// hidden backdoors - they can dump every credential in the domain
// without being in the obvious high-privilege groups.

MATCH (n)-[:DCSync]->(d:Domain)
OPTIONAL MATCH (n)-[:MemberOf*1..]->(da:Group)
WHERE da.name STARTS WITH "DOMAIN ADMINS@"
WITH n, d, da
WHERE da IS NULL
RETURN n.name AS principal, labels(n) AS type, d.name AS domain
EOF

What does this query do?

The DCSync edge in BloodHound represents the combined GetChanges and GetChangesAll privileges on a domain object. Any principal with this edge can replicate all password hashes from the domain controller.

The OPTIONAL MATCH checks whether each DCSync principal is a member of Domain Admins. The WHERE da IS NULL filter keeps only principals who are NOT Domain Admins. These are hidden backdoors that most defenders overlook.

  • Confirm all four query files were created by running:
ls ~/bloodhound-project/queries/

You should see acl-abuse-chain.cypher, dcsync-non-da.cypher, kerberoastable-with-da-path.cypher, and shortest-path-da.cypher listed.

Don't see all four files?

Check that each cat command completed without error. The heredoc syntax (<< 'EOF') requires the closing EOF to be on its own line with no leading spaces. If a file is missing, re-run the corresponding command.

help me troubleshoot why my Cypher query files are not being created

Test your queries in BloodHound

You can verify these queries work by copying the Cypher content and pasting it into the Cypher tab in BloodHound CE. Each query should return results against the loaded sample data.

✔️ Awesome, I've got everything!

Great. Make sure all your files are saved. Your ~/bloodhound-project/ directory should now contain REPORT.md (with your findings), README.md, CHALLENGE.md, SOLUTION.md, and the four .cypher files in queries/.

ⓧ I'd like to double check the full code

Here is the complete shortest-path-da.cypher file:

// Find shortest paths from any user to Domain Admins
// This is the most fundamental attack path query - it reveals
// how many hops separate standard users from full domain compromise.
// Cypher is case-sensitive: group names use UPPERCASE@DOMAIN format.

MATCH p=shortestPath((n:User)-[*1..]->(m:Group))
WHERE m.name STARTS WITH "DOMAIN ADMINS@"
RETURN p

Here is the complete kerberoastable-with-da-path.cypher file:

// Find Kerberoastable users who have a path to Domain Admins
// These accounts have SPNs set, making them vulnerable to offline
// password cracking. If they also have a path to DA, cracking their
// password gives an attacker a route to full domain compromise.

MATCH (u:User {hasspn: true})
MATCH p=shortestPath((u)-[*1..]->(g:Group))
WHERE g.name STARTS WITH "DOMAIN ADMINS@"
RETURN u.name, length(p) AS hops, p
ORDER BY hops ASC

Here is the complete acl-abuse-chain.cypher file:

// Find ACL abuse chains leading to Domain Admins
// Restricts traversal to ACL-based edges only: GenericAll, GenericWrite,
// WriteDacl, WriteOwner, ForceChangePassword, and Owns.
// These edges represent permissions that can be directly abused
// without needing credentials or network access.

MATCH p=shortestPath((n:User)-[:GenericAll|GenericWrite|WriteDacl|WriteOwner|ForceChangePassword|Owns*1..]->(m:Group))
WHERE m.name STARTS WITH "DOMAIN ADMINS@"
RETURN p

Here is the complete dcsync-non-da.cypher file:

// Find principals with DCSync rights who are NOT Domain Admins
// DCSync allows replicating password hashes from the domain controller.
// Principals with this right who are not in Domain Admins represent
// hidden backdoors - they can dump every credential in the domain
// without being in the obvious high-privilege groups.

MATCH (n)-[:DCSync]->(d:Domain)
OPTIONAL MATCH (n)-[:MemberOf*1..]->(da:Group)
WHERE da.name STARTS WITH "DOMAIN ADMINS@"
WITH n, d, da
WHERE da IS NULL
RETURN n.name AS principal, labels(n) AS type, d.name AS domain

Your project directory is now fully structured with a professional report and reusable queries. Next up, you will create the challenge and solution documents that turn this project into something others can learn from.

Create the Challenge and Solution

Your professional findings report is complete. Now you'll create something that sets you apart from other candidates: a reproducible challenge that lets anyone learn from your work.

Hiring managers notice when a candidate can teach, not just perform. By packaging your analysis as a challenge with guided questions and a full solution walkthrough, you demonstrate both technical depth and communication skills.

In this step, get ready to:
  • Write a challenge document with 5-7 questions of increasing difficulty.
  • Write a full solution walkthrough with explanations and evidence.
  • Add cross-references and structure so the challenge is self-contained.
Write CHALLENGE.md

A good challenge guides learners through discovery without handing them the answer. Each question should build on the previous one, starting with orientation tasks and progressing to complex analysis.

  • Open CHALLENGE.md in your text editor from the ~/bloodhound-project folder.
  • Replace the stub content with your challenge document. Use the following structure as a starting template:
# Active Directory Attack Path Challenge

## Introduction

This is a hands-on challenge using BloodHound Community Edition and the official
SpecterOps Active Directory sample dataset. The dataset contains 3 collected
domains with trust relationships, ADCS escalation paths, and local permissions
coverage.

**Prerequisites:**
- A running BloodHound CE instance
- The official AD sample data ingested (download from BloodHound CE's Quick Upload)
- Familiarity with BloodHound's search, pathfinding, and Cypher tabs

## Challenge Questions

### Question 1: Domain Enumeration (Easy)

How many domains are in the dataset? What trust relationships exist between them?

**Hint:** Use the search bar to look for Domain objects. Check the domain node
info panels for trust details.

---

### Question 2: Shortest Path to Domain Admin (Easy)

Find the shortest path from BOB@PHANTOM.CORP to ADMINISTRATORS@PHANTOM.CORP.
How many hops does it take? What edge types are involved?

**Hint:** Use the Pathfinding tab on the Explore page. Enter the start and end
nodes to visualise the path.

---

### Question 3: Kerberoasting Risk (Medium)

Identify all Kerberoastable accounts in the dataset. Which one has the shortest
path to Domain Admin? How many hops?

**Hint:** Search for users with SPNs set. Then use pathfinding from each
Kerberoastable user to the Domain Admins group.

---

### Question 4: ACL Abuse (Medium)

Find a user who has GenericAll on a Domain Admin group member. Describe the full
abuse scenario from initial access to domain compromise.

**Hint:** Look for GenericAll, GenericWrite, or WriteDACL edges targeting members
of high-value groups. The node info panel shows inbound object control.

---

### Question 5: Hidden DCSync (Medium)

Identify all principals with DCSync privileges who are NOT members of Domain
Admins. Why is this dangerous from a detection standpoint?

**Hint:** DCSync requires both GetChanges and GetChangesAll on the domain object.
Check the domain node's inbound control rights.

---

### Question 6: ADCS Escalation (Hard)

Find an ADCS escalation path in the dataset. Which certificate template is
misconfigured? What type of ESC vulnerability does it represent?

**Hint:** Look for certificate template nodes and their relationships. Check
enrollment permissions and template settings that allow subject alternative name
manipulation.

---

### Question 7: Custom Cypher Query (Hard)

Write a Cypher query to find all users within 2 hops of Domain Admin via ACL
abuse edges only (GenericAll, GenericWrite, WriteDACL, WriteOwner,
ForceChangePassword).

**Hint:** Use the Cypher tab. You will need a MATCH pattern with variable-length
relationship syntax and a WHERE clause filtering edge types.

What makes a good challenge question?

Each question targets a different BloodHound skill. Questions 1-2 teach basic navigation and pathfinding. Questions 3-5 require interpreting graph relationships. Questions 6-7 demand deeper analysis and query writing.

The hints give direction without revealing the answer. They point to the right feature or tab, but the learner still needs to interpret results on their own.

  • Customise the questions to match the specific paths you discovered in Step 2. Replace any example names with the actual principals and paths you found in your analysis.
  • Save CHALLENGE.md.

Not sure what questions to write?

Return to BloodHound CE in Firefox and revisit the paths you documented in your report. Each finding in REPORT.md can become a challenge question. Frame the question so the reader needs to discover what you already found.

Help me write challenge questions based on my BloodHound findings.

Write SOLUTION.md

The solution walkthrough is where you demonstrate your ability to explain complex attack paths clearly. Each solution should read like a mini-tutorial that teaches the reader both the how and the why.

  • Open SOLUTION.md in your text editor.
  • Replace the stub content with your solution walkthrough. Use this structure as a starting point:
# Solutions Walkthrough

> **SPOILER WARNING:** Try the challenge first before reading these solutions.
> Open CHALLENGE.md and attempt each question on your own. You will learn far
> more by struggling with the problem before seeing the answer.

---

## Solution 1: Domain Enumeration

**Steps:**
1. In BloodHound CE, use the search bar to search for Domain objects.
2. Click each domain node to view its info panel.
3. Check the trust relationships listed under each domain's properties.

**Answer:**
The dataset contains 3 collected domains: PHANTOM.CORP, [YOUR-DOMAIN-2],
and [YOUR-DOMAIN-3]. Trust relationships include [describe the trust
directions and types you found].

**Why this matters:**
Domain enumeration is the first step in any AD assessment. Trust relationships
define the boundary of potential lateral movement. A bidirectional trust means
compromising one domain can lead to compromising the other.

**Screenshot:** See screenshots/domain-trusts.png

---

## Solution 2: Shortest Path to Domain Admin

**Steps:**
1. Navigate to the Explore page in BloodHound CE.
2. Click the Pathfinding tab.
3. Enter BOB@PHANTOM.CORP as the start node.
4. Enter ADMINISTRATORS@PHANTOM.CORP as the end node.
5. Click Find Path.

**Answer:**
The shortest path takes [X] hops. The edges involved are:
- Hop 1: BOB@PHANTOM.CORP -[EDGE_TYPE]-> [NEXT_NODE]
- Hop 2: [NEXT_NODE] -[EDGE_TYPE]-> [NEXT_NODE]
- [Continue for each hop]

**Cypher query used:**
```cypher
MATCH p=shortestPath((u:User {name:"BOB@PHANTOM.CORP"})-[*1..]->(g:Group {name:"ADMINISTRATORS@PHANTOM.CORP"}))
RETURN p
```

**Offensive narrative:**
An attacker who compromises Bob's account (via phishing, credential stuffing, or
Kerberoasting) would [describe each step an attacker would take along the path].

**Screenshot:** See screenshots/shortest-path-bob-da.png

---

## Solution 3: Kerberoasting Risk

**Steps:**
1. Search for users with SPN set (Kerberoastable accounts).
2. For each Kerberoastable user, use Pathfinding to check for paths to
   Domain Admins.
3. Compare path lengths to identify the shortest.

**Answer:**
[NAME]@[DOMAIN] has the shortest path to Domain Admin at [X] hops.
The Kerberoastable accounts found are: [list them].

**Cypher query used:**
```cypher
MATCH (u:User {hasspn:true})
MATCH p=shortestPath((u)-[*1..]->(g:Group {name:"DOMAIN ADMINS@PHANTOM.CORP"}))
RETURN u.name, length(p) AS hops
ORDER BY hops ASC
```

**Offensive narrative:**
Kerberoasting allows any authenticated domain user to request a service ticket
for accounts with SPNs. The ticket is encrypted with the service account's
password hash and can be cracked offline. Once [ACCOUNT] is compromised, the
attacker follows the path: [describe each hop].

**Screenshot:** See screenshots/kerberoast-to-da.png

---

## Solution 4: ACL Abuse

**Steps:**
1. Search for Domain Admin group members.
2. Click each member and check their "Inbound Object Control" section.
3. Look for GenericAll, GenericWrite, or WriteDACL edges from non-admin users.
4. Trace the full chain from the controlling user back to an initial foothold.

**Answer:**
[USER]@[DOMAIN] has GenericAll on [DA_MEMBER]@[DOMAIN]. The full abuse
scenario:
1. Attacker compromises [USER] (e.g., via password spray).
2. GenericAll allows the attacker to reset [DA_MEMBER]'s password.
3. Attacker authenticates as [DA_MEMBER] who is a Domain Admin.
4. Full domain compromise achieved.

**Why this matters:**
ACL misconfigurations are invisible in normal security audits. They do not
generate logs by default and persist until explicitly removed. Many organisations
have accumulated dangerous ACL entries over years of delegation changes.

**Screenshot:** See screenshots/acl-abuse-chain.png

---

## Solution 5: Hidden DCSync

**Steps:**
1. Navigate to the domain node (e.g., PHANTOM.CORP).
2. Check inbound control rights for GetChanges and GetChangesAll.
3. Cross-reference with Domain Admins membership to find non-DA principals
   with DCSync rights.

**Answer:**
The following principals have DCSync privileges but are NOT Domain Admins:
- [PRINCIPAL_1]@[DOMAIN]
- [PRINCIPAL_2]@[DOMAIN]

**Cypher query used:**
```cypher
MATCH (d:Domain {name:"PHANTOM.CORP"})
MATCH p1=(n)-[:GetChanges]->(d)
MATCH p2=(n)-[:GetChangesAll]->(d)
WHERE NOT (n)-[:MemberOf*1..]->(:Group {name:"DOMAIN ADMINS@PHANTOM.CORP"})
RETURN DISTINCT n.name
```

**Why this matters:**
DCSync allows replication of password hashes from the domain controller.
Principals with this right who are not Domain Admins are often overlooked during
audits. An attacker who compromises one of these accounts can extract every
credential in the domain without touching the DC.

**Screenshot:** See screenshots/dcsync-non-da.png

---

## Solution 6: ADCS Escalation

**Steps:**
1. Search for certificate template nodes in BloodHound CE.
2. Examine enrollment permissions and template configurations.
3. Identify templates that allow low-privileged users to specify a Subject
   Alternative Name (SAN) or have other dangerous settings.

**Answer:**
The certificate template [TEMPLATE_NAME] is vulnerable to [ESC type].
[Describe the misconfiguration: who can enroll, what dangerous settings exist,
and how an attacker abuses it to escalate privileges.]

**Offensive narrative:**
1. Attacker enrols for a certificate using [TEMPLATE_NAME].
2. [Describe the specific ESC abuse steps].
3. Attacker authenticates as [HIGH_PRIV_ACCOUNT] using the issued certificate.
4. Domain compromise achieved via certificate abuse.

**Screenshot:** See screenshots/adcs-escalation.png

---

## Solution 7: Custom Cypher Query

**Steps:**
1. Open the Cypher tab in BloodHound CE's Explore page.
2. Write a query using variable-length relationship syntax.
3. Filter edges to ACL abuse types only.

**Cypher query:**
```cypher
MATCH p=(u:User)-[:GenericAll|GenericWrite|WriteDACL|WriteOwner|ForceChangePassword*1..2]->(g:Group {name:"DOMAIN ADMINS@PHANTOM.CORP"})
RETURN u.name, length(p) AS hops
ORDER BY hops ASC
```

**Answer:**
The following users are within 2 ACL abuse hops of Domain Admin:
- [USER_1]@[DOMAIN] (1 hop via [EDGE_TYPE])
- [USER_2]@[DOMAIN] (2 hops via [EDGE_1] then [EDGE_2])

**Why this matters:**
ACL-only paths are the most dangerous because they require no exploitation of
vulnerabilities. They abuse legitimate Active Directory features. Each user in
this list represents an identity that, if compromised, gives an attacker a
direct administrative path using only built-in AD functionality.

**Screenshot:** See screenshots/cypher-acl-2hop.png

What makes a strong solution walkthrough?

Each solution has five parts: the exact steps to reproduce the finding, the answer itself, the Cypher query used (where applicable), a screenshot reference, and the security explanation.

The offensive narrative is what separates a checkbox audit from real analysis. It tells the reader exactly what an attacker would do at each step, translating graph edges into real-world actions.

  • Replace every placeholder (text in square brackets like [YOUR-DOMAIN-2]) with the actual values from your BloodHound analysis.
  • Fill in each offensive narrative with the specific steps an attacker would take along the paths you discovered.
  • Save SOLUTION.md.

Reference your existing queries

You already have working Cypher queries saved in your queries/ folder from Step 2. Copy those directly into the relevant solutions. This keeps your project consistent and saves time.

Add cross-references and verify structure

The challenge and solution files should reference each other so readers can navigate between questions and answers without confusion.

  • Open CHALLENGE.md and add a note at the bottom pointing readers to the solutions. Add this line after your last question:
---

## Ready to check your answers?

See [SOLUTION.md](SOLUTION.md) for full solutions, Cypher queries, and
explanations for each question.
  • Save CHALLENGE.md.
  • Open SOLUTION.md and confirm the spoiler warning is at the very top of the file, before any solutions.
  • Verify that each solution heading matches the corresponding challenge question number (Solution 1 answers Question 1, and so on).

Why is the spoiler warning important?

When someone clones your repo, the solution file is immediately visible. The warning respects the reader's choice to learn by doing. It also signals that you designed the challenge intentionally, not just as an afterthought.

  • Do a final self-contained test: read through CHALLENGE.md as if you were a stranger with BloodHound CE and the sample data loaded. Can you attempt every question using only the information in the challenge file and the hints?
  • Confirm that each solution references a screenshot filename that exists in your screenshots/ folder.
  • Verify your files are complete by running:
ls ~/bloodhound-project/

You should see CHALLENGE.md, SOLUTION.md, REPORT.md, README.md, and the screenshots/ and queries/ directories listed.

Missing files or empty content?

If CHALLENGE.md or SOLUTION.md appear empty, check that you saved them after pasting the content. Some editors require an explicit save action.

If screenshot filenames in your solutions do not match actual files in screenshots/, run ls ~/bloodhound-project/screenshots/ to see what is there and update your references to match.

Help me verify my challenge and solution files are properly structured.

Your challenge and solution are ready. The last piece is packaging everything into a public GitHub repository with a polished README. Next up, you will write your README, commit your work, and push it live for the world to see.

Publish the GitHub Repository

Your findings report, challenge document, and solution walkthrough are all written. Now it's time to package everything into a public GitHub repository that hiring managers and security professionals can discover and learn from.

A well-structured repository with a clear README is the difference between local files on your VM and a permanent portfolio piece. This step turns your analysis into something anyone can click, reproduce, and evaluate.

In this step, get ready to:
  • Write a comprehensive README.md with setup instructions and project navigation.
  • Commit all files and push to a public GitHub repository.
  • Verify the repository renders correctly and add discoverability topics.
Write README.md

The README is the first thing visitors see when they land on your repository. It needs to explain what this project is, how to reproduce it, and where to find the key deliverables.

  • Open README.md in the ~/bloodhound-project/ directory with your preferred text editor.
  • Replace the stub content with the following README structure:
# Active Directory Attack Path Analysis with BloodHound CE

Professional AD attack path analysis using BloodHound Community Edition, with a reproducible challenge for others to attempt.

## Overview

This project demonstrates Active Directory attack path analysis using BloodHound CE and the official SpecterOps multi-domain sample dataset. It identifies critical privilege escalation paths, documents findings in a professional pentest report format, and provides a challenge others can attempt against the same data.

Designed for security professionals, pentest students, and anyone learning AD attack path analysis.

## Repository Structure

```
.
├── README.md          # This file - setup and navigation
├── REPORT.md          # Professional pentest findings report
├── CHALLENGE.md       # Hands-on challenge questions (try before reading solutions)
├── SOLUTION.md        # Full solutions with explanations
├── queries/           # Reusable Cypher queries with comments
│   ├── shortest-path-da.cypher
│   ├── kerberoastable-with-da-path.cypher
│   ├── acl-abuse-chain.cypher
│   └── dcsync-non-da.cypher
└── screenshots/       # Evidence screenshots of attack paths
```

## Prerequisites

- Kali Linux VM with 8GB RAM allocated
- Docker installed (`sudo apt install -y docker.io`)
- A GitHub account

## Quick Start

1. Install Docker on Kali:
   ```bash
   sudo apt update && sudo apt install -y docker.io
   sudo systemctl enable docker --now
   sudo usermod -aG docker $USER
   ```
   Log out and back in after adding yourself to the docker group.

2. Download and run BloodHound CE:
   ```bash
   wget https://github.com/SpecterOps/bloodhound-cli/releases/latest/download/bloodhound-cli-linux-amd64.tar.gz
   tar -xvzf bloodhound-cli-linux-amd64.tar.gz
   ./bloodhound-cli install
   ```

3. Open http://localhost:8080/ui/login and log in with the generated credentials.

4. Upload the sample data via **Quick Upload** in the left menu.

## Challenge

Want to test your BloodHound skills? See [CHALLENGE.md](CHALLENGE.md) for guided tasks of increasing difficulty. Try them before reading the solutions.

## Report

The full professional findings report is in [REPORT.md](REPORT.md), including severity ratings, attack path narratives, and prioritised remediation.

## Cleanup

To fully remove BloodHound CE and reclaim disk space:

```bash
./bloodhound-cli uninstall
docker system prune -a --volumes
```

## Author

Your Name - Security professional with certifications in CPSA, Google Cybersecurity, and CompTIA Security+.

Contact: your-email@example.com | GitHub: @your-username

What does this README include?

  • A one-sentence project description that immediately communicates purpose.
  • A repository structure diagram so visitors know where to find each deliverable.
  • Quick Start commands so anyone can reproduce your environment from scratch.
  • Pointers to the challenge and report documents so visitors can jump straight to the content that interests them.
  • Update the Author section at the bottom with your real name, certifications, and contact details.
  • Save README.md.

Personalise the overview

If you discovered additional findings beyond the four required ones, mention them in the Overview section. The more specific your README is to your actual work, the more impressive it reads.

Commit and push to GitHub

With all your files complete, you can initialise a Git repository and push everything to GitHub in one go.

  • Initialise a Git repository and commit all files by running these commands:
cd ~/bloodhound-project
git init
git add .
git commit -m "AD attack path analysis: report, challenge, and BloodHound queries"

What do these commands do?

  • git init creates a new Git repository in the current folder.
  • git add . stages every file in the directory for commit (your Markdown files, queries, and screenshots).
  • git commit -m "..." saves a snapshot of all staged files with a descriptive message.

Now you need to create the remote repository on GitHub to push your local files to.

  • Open Firefox and go to https://github.com/new.
  • Enter bloodhound-ad-analysis as the repository name.
  • Select **Public** for the visibility.
  • Leave all other options unchecked (no README, no .gitignore, no license). You already have your own README.
  • Click **Create repository**.

Why leave the checkboxes unchecked?

GitHub auto-generates files when you check those boxes. Since you already have a README.md and all your project files committed locally, adding GitHub's versions would create merge conflicts on your first push.

  • Back in your terminal, add the remote origin and push by running these commands:
git remote add origin https://github.com/[[GITHUB_USERNAME="YOUR-USERNAME"]]/bloodhound-ad-analysis.git
git branch -M main
git push -u origin main

What do these commands do?

  • git remote add origin links your local repository to the GitHub repository you just created.
  • git branch -M main renames your default branch to main (GitHub's default branch name).
  • git push -u origin main uploads all your committed files to GitHub.
  • When prompted, enter your GitHub username and a personal access token (or password if you have one configured).

Push rejected or authentication failed?

  • If you see an authentication error, GitHub requires a personal access token instead of a password for HTTPS pushes. Generate one at **Settings > Developer settings > Personal access tokens > Tokens (classic)** with the repo scope.
  • If you see "remote already exists", you may have mistyped the URL on a previous attempt. Remove it with git remote remove origin and re-add with the correct URL.
  • If you see "failed to push some refs", make sure you left all checkboxes unchecked when creating the GitHub repository (no auto-generated files).

Why can't I push to GitHub?

Verify and polish the repository

Your files are live on GitHub. Take a moment to verify everything renders correctly and add metadata that makes the repository discoverable.

  • In Firefox, navigate to your new repository at https://github.com/ followed by your username and /bloodhound-ad-analysis.
  • Confirm the README renders cleanly on the repository's main page.
  • Click into the screenshots/ folder and confirm your images display correctly.
  • Click CHALLENGE.md, SOLUTION.md, and REPORT.md to verify each file is accessible and formatted.

Now add a description and topic tags so people can find your repository through GitHub search.

  • On your repository's main page, click the gear icon to the right of **About** (near the top right).
  • In the **Description** field, enter a one-sentence summary such as: AD attack path analysis with BloodHound CE - findings report, reproducible challenge, and Cypher queries.
  • In the **Topics** field, add these tags one at a time: active-directory, bloodhound, pentesting, attack-paths.
  • Click **Save changes**.

Finally, pin this repository to your GitHub profile so it appears front and centre when someone visits your page.

  • Click your profile picture in the top right corner of GitHub, then click **Your profile**.
  • In the **Popular repositories** or **Pinned** section, click **Customize your pins**.
  • Select the bloodhound-ad-analysis repository from the list.
  • Click **Save pins**.

Why pin the repository?

Pinned repositories are the first thing hiring managers see when they visit your GitHub profile. By pinning this project, you ensure your AD analysis work is immediately visible without anyone needing to scroll through your repository list.

Secret mission

Custom Cypher Queries for Advanced Analysis

You have identified attack paths using BloodHound's built-in queries. But the pre-built options only scratch the surface. Real penetration testers write custom Cypher queries to discover hidden privilege escalation paths that automated tools miss. In this secret mission, you will write three advanced Cypher queries that go beyond the defaults and add them as bonus challenges to your repository.

Clean Up Your Resources

Clean Up Your Resources

This project runs entirely on your local Kali VM using Docker. There are no cloud services or ongoing costs. Decide whether to keep your resources running, pause them to come back later, or delete them entirely.

Resources you used:

  • Docker containers running BloodHound CE (database, application, and UI layers).
  • Docker images (~3-4 GB disk space).
  • Docker volumes storing graph data.
  • bloodhound-cli binary and tarball in your home directory.
  • Local project files in ~/bloodhound-project/.

Keep everything running

No action needed. Choose this if you are still actively building or want to explore BloodHound CE further.

  • Your BloodHound containers will restart automatically when Docker starts.
  • Your GitHub repository remains live as a permanent portfolio piece.
  • The Docker images and volumes will continue to use approximately 3-4 GB of disk space.

Pause - I'll come back to this later

Stop the running containers to free up RAM, but keep everything on disk so you can resume later.

  • Stop BloodHound CE containers by running:
cd ~
./bloodhound-cli containers down
  • Your Docker images and volumes stay on disk. To start again later, run ./bloodhound-cli containers up.
  • Your GitHub repository and local project files are unaffected.

Delete - I don't want to use this again

Remove all project resources and return your system to its original state. Your GitHub repository remains as the permanent portfolio piece.

  • Uninstall BloodHound CE (removes containers, images, and volume data) by running:
cd ~
./bloodhound-cli uninstall
  • Remove any remaining Docker images and volumes to reclaim disk space by running:
docker system prune -a --volumes
  • Remove the bloodhound-cli binary and tarball by running:
rm -f ~/bloodhound-cli ~/bloodhound-cli-linux-amd64.tar.gz
  • Remove the local project files by running:
rm -rf ~/bloodhound-project
  • (Optional) Remove Docker entirely from Kali by running:
sudo systemctl disable docker --now
sudo apt remove --purge -y docker.io
sudo apt autoremove -y
sudo rm -rf /var/lib/docker /var/lib/containerd
  • (Optional) Reduce your Kali VM RAM back to 4 GB. Shut down the VM, then go to VirtualBox > Settings > System > Motherboard and set Base Memory to 4096 MB.

Nice Work!

Nice Work!

You just completed a professional Active Directory attack path analysis and published it as a reproducible project on GitHub. This is the kind of work that demonstrates both technical depth and communication skills to hiring managers.

You've learned how to:

  • Deploy BloodHound Community Edition on Kali Linux using Docker, ingest a multi-domain Active Directory sample dataset, and identify critical privilege escalation paths including Kerberoasting, ACL abuse chains, and ADCS misconfigurations.
  • Produce a professional pentest findings report with severity ratings, attack path narratives, evidence references, and prioritised remediation recommendations.
  • Publish a reproducible GitHub repository containing a challenge document, solution walkthrough, reusable Cypher queries, and a README that lets anyone replicate your analysis.
  • Secret Mission: Write custom Cypher queries for DCSync detection, cross-domain trust abuse, and tier zero exposure analysis.

Ready to quiz yourself?