Active › Module 4 › Lesson 2
BloodHound Named
BloodHound names attack-path graph literacy — understand nodes and edges on $LAB_AD exports; defenders use same graphs for remediation.
Visual · t25_bloodhound_named
BloodHound graph literacy. $LAB_AD only. Original Cyberlium.
Opening
BloodHound is a graph of AD relationships — literacy means reading paths, not harvesting stranger tenants.
BloodHound ingests AD data (users, groups, sessions, ACLs, trusts) and visualizes paths to high-value targets. Nodes: users, computers, groups, domains. Edges: MemberOf, AdminTo, HasSession, GenericAll, etc. Defenders use the same graphs to prioritize remediation (edge removal, tiering). Cyberlium teaches graph reading on YOUR $LAB_AD collector output — not running collectors against unauthorized forests. Next: Enum Hygiene.
1. Graph concepts (named)
Path: sequence of edges from source node to target (e.g., Domain Admins). Shortest path queries answer 'how could this account reach Tier 0?' — purple teams document paths with mitigations.
On $LAB_AD, label three node types and two edge types from course graph screenshot — no live collector on production.
Command guide
Try these commands — Graph concepts (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
BloodHound docs — https://bloodhound.readthedocs.io/ (graph literacy — NOT collector on strangers) SpecterOps BloodHound — https://bloodhound.specterops.io/ (official docs literacy) MITRE T1069 — https://attack.mitre.org/techniques/T1069/ (permission groups discovery)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Built-in (PowerShell: Invoke-WebRequest) Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export LAB_AD=${LAB_AD:-$HOME/cyberlium-lab/t25-ad}
python3 - <<'PY'
print('BloodHound: graph tool for AD attack paths — DOCS literacy only here')
print('Collector runs ONLY against YOUR lab domain with explicit RoE')
print('NEVER: BloodHound ingestor on employer/school/random domains')
PYCommand — copy this
curl -sS https://bloodhound.readthedocs.io/ | head -8 curl -sS https://bloodhound.specterops.io/ | head -5
Primary tools to practice this lesson: curl, python3. Reference sites: BloodHound docs (https://bloodhound.readthedocs.io/); SpecterOps BloodHound (https://bloodhound.specterops.io/); MITRE T1069 (https://attack.mitre.org/techniques/T1069/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Collector hygiene (lab scope)
Collectors run inside authorized scope only — $LAB_AD enrollment or GOAD VLAN. Store exports encrypted, chmod 600, delete when lab resets. Never upload stranger domain graphs to public BloodHound instances.
Literacy: collector = sensitive read of directory — treat output like credential-adjacent data.
3. Defender use of same graphs
Blue teams import data to find excessive AdminTo, session on Tier 0, ACL abuse paths — then remove edges via group cleanup, LAPS, tiering, and ACL hardening.
Ship: BloodHound literacy card — three node types, two edges, one remediation action per edge class. Next: Enum Hygiene.
4. What you ship: BloodHound graph literacy card for $LAB_AD
Node/edge definitions, collector scope rule, one remediation example. NO stranger collector runs. chmod 600.
5. What you record before the next lesson
Date. BloodHound card. $LAB_AD named. File t25-m04-l02-bloodhound-named.txt chmod 600.
6. Wrong vs right: stranger-domain attacks vs lab AD literacy
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Run BloodHound collector on employer AD without scope. Share lab graph with real usernames publicly.
Right
Write graph literacy card from YOUR $LAB_AD course material. Next: Enum Hygiene.
Mission: name BloodHound graph parts
1) Define node and edge in one line each. 2) Name two edge types. 3) One defender remediation per edge. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Same graph defenders use to prioritize ACL cleanup.
Knowledge Check
APPLY: BloodHound literacy means:
Multiple choice
Knowledge Check
APPLY: True or False: BloodHound visualizes paths via nodes and edges.
True or False
Knowledge Check
APPLY: Collector output should be treated as:
Multiple choice