BloodHound Tutorial 2026 — Find the SHORTEST Path to Domain Admin in Minutes | Day 27

This tutorial teaches BloodHound, a free Active Directory attack path visualization tool that uses graph theory and shortest path algorithms to identify routes from standard domain users to Domain Admin compromise in minutes rather than days. The article covers BloodHound's conceptual foundation, installation of BloodHound CE and Neo4j via Docker, data collection using SharpHound and bloodhound-python, query execution to find attack paths, interpretation of graph edges as exploitation techniques, and practical reporting of findings. BloodHound matters because real AD environments accumulate undocumented permission chains through group memberships, legacy delegations, and unrevoiced admin rights that create compromise paths typically only 3–5 relationships away from any standard user.

• Graph theory reduces manual AD analysisBloodHound represents Active Directory as a mathematical graph where nodes are AD objects (users, groups, computers, GPOs, domains) and edges are relationships (MemberOf, AdminTo, HasSession, GenericAll). It applies Dijkstra's shortest path algorithm to automatically identify the minimum relationship-hops needed to reach Domain Admin from any starting point, replacing weeks of manual permission review with minutes of automated analysis.
• Every BloodHound edge maps to exploitation techniqueEach relationship type in BloodHound corresponds directly to a specific attack technique: AdminTo enables credential dumping with Mimikatz, HasSession allows credential theft from LSASS if local admin, MemberOf inherits all group rights, GenericAll provides full control to reset passwords or modify ACLs, DCSync replicates DC to dump hashes, WriteDacl modifies ACLs to grant yourself GenericAll, and ForceChangePwd resets user passwords. Understanding this mapping transforms a BloodHound graph from a visual diagram into an executable attack plan.
• BloodHound CE Docker deployment simplifies setupBloodHound CE installs via a single Docker Compose command that spins up Neo4j graph database, PostgreSQL, and the BloodHound web interface at localhost:8080. This replaces the legacy setup requiring separate Neo4j and Electron installations. For data collection on Kali, bloodhound-python runs directly from the command line with domain user credentials, eliminating the need to execute SharpHound on Windows machines in stealth-sensitive engagements.
• SharpHound collects relationship data, not via brute forceSharpHound queries LDAP, SMB, and RPC to enumerate AD relationships and outputs JSON files covering users, groups, computers, GPOs, domains, and OUs. Collection flags include: -c All (standard full collection), -c DCOnly (stealth mode avoiding direct computer enumeration), and --Loop (recurring collection every 15 minutes for session data). bloodhound-python provides equivalent functionality from Kali without Windows-side execution.
• Built-in queries identify highest-value attack pathsBloodHound provides pre-built Cypher queries covering the most impactful attack patterns: 'Find Shortest Paths to Domain Admins' (primary attack path discovery), 'Find Principals with DCSync Rights' (AD password replication), 'Find Kerberoastable Accounts' (offline hash cracking targets), 'Find AS-REP Roastable Users' (pre-auth not required accounts), and 'Find Computers with Unconstrained Delegation' (high-value targets). The 'Mark as Owned' feature shows immediate paths from any compromised account to Domain Admin, providing operational intelligence during engagements.
• Permission complexity accumulates over yearsThe article explains that Domain Admin is typically only 3–5 relationships away from standard users not necessarily due to poor security design but because AD environments accumulate permission complexity: group memberships from old projects, local admin rights granted for troubleshooting and never revoked, and delegation configurations for legacy applications create undocumented paths. The example of a six-year-old decommissioned system's forgotten delegation group creating a five-hop Domain Admin path illustrates this risk.
• Pentest reports require technical contextualizationBloodHound graphs are impactful in penetration test reports but require specific documentation: export the graph image, number each step with nodes and edges, specify the exploitation technique and tool names for each edge traversal, identify the starting account and access level, and provide remediation recommendations specific to each node in the path rather than generic permission fixes. This transforms a visual diagram into actionable remediation guidance for the client's security team.
• No Domain Admin credentials required for collectionStandard domain user credentials collect most relationship data including group memberships, ACLs, and AD object relationships sufficient for the Shortest Path to Domain Admin analysis. Local admin on target machines is required only for session data collection, but core attack path identification works with any domain-level user account.

Bottom line: BloodHound automates Active Directory attack path discovery using graph theory and shortest path algorithms, transforming what experienced penetration testers manually perform over days into a minutes-long analysis that identifies exploitation chains typically 3–5 relationships away from any standard user. Each discovered relationship maps directly to a specific exploitation technique (credential dumping, Kerberos abuse, ACL modification, password reset), enabling pentesters to execute theoretic