> For the complete documentation index, see [llms.txt](https://xedex.gitbook.io/internalpentest/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://xedex.gitbook.io/internalpentest/internal-pentest/active-directory/reconnaissance/bloodhound.md).

# BloodHound

BloodHound uses graph theory to reveal the hidden and often unintended relationships within an Active Directory environment. Attacks can use BloodHound to easily identify highly complex attack paths that would otherwise be impossible to quickly identify.

You can find the tool here :

{% embed url="<https://github.com/BloodHoundAD/Bloodhound/wiki>" %}

After installing it, start your neo4j plateform :

```
neo4j console
```

and start your bloodhound in another tab by typing&#x20;

```
bloodhound
```

\
Now bloodhound needs data,  and it does so by using an ingestor called [SharpHound](https://github.com/BloodHoundAD/BloodHound/blob/master/Ingestors/SharpHound.ps1), you should download, move and execute that script on your domain user that you compromised by typing

```
powershell -ep bypass
. .\SharpHound.ps1
Invoke-BloodHound -CollectionMethod All -Domain TARGETDOMAIN -ZipFileName bloodhound.zip
```

once you finish that, copy the zip file to your system, and feed it to bloodhound through drag and drop or import data functionality.