dirkjanm

BloodHound.py: Collect Active Directory Data with Impacket

BloodHound.py is a Python ingestor built on Impacket that collects Active Directory data for BloodHound analysis. It suits security teams and testers who need to map domain relationships, permissions, sessions, and local administrators.

MaintainedPythonMITCLICybersecuritySecurity Tools
View on GitHub Compare
Stars
2.5k
Forks
382
Last commit
1 day ago
Contributors
41
Releases, 12 months
0

Our take

Maintaineda few commits in the last 90 days

Health score

40/100

How it is scored
Activity
30
Community
49
Issues
35
Pull requests
44
  • Slower to close issues than 93% of the projects we track

This is a focused, actively maintained Python ingestor, but adoption should account for its legacy-version scope, slow issue resolution, and reliance on a highly concentrated contributor base.

Good fit if

  • You need to collect Active Directory data for BloodHound 4.2 or 4.3 using a Python tool built on Impacket.
  • You want to select specific collection methods or run domain-controller-only collection.
  • You can work with Python and, if useful, its optional Docker setup.

Look elsewhere if

  • You need the default branch to support BloodHound CE. The project directs CE users to a separate branch and package.
  • You require all SharpHound collection features, since GPO local groups are not supported.
  • You need frequent releases or fast issue handling. There have been no releases in over a year, and issues take a long time to close.
All health signals
Last commit2026-10-23 (1 day ago)
Commits, last 90 days2
Releases, last 12 months0
Contributors41 (top contributor: 82% of commits)
Issues closed, last 90 days5 (typically closed in 347 days)
Pull requests merged, last 90 days1
Project age8 years

Checked on 2026-10-25 with the GitHub API.

Overview

BloodHound.py is a Python-based ingestor built on Impacket for collecting Active Directory data for BloodHound. It helps security teams and penetration testers map domain relationships and identify permissions, sessions, and local administrator access for analysis in BloodHound.

The default branch targets BloodHound versions 4.2 and 4.3. BloodHound CE users should use the project's separate bloodhound-ce branch and its bloodhound-ce-python command instead.

Key Features

  • Collects domain users, computers, groups, trusts, sessions, and local administrators.
  • Supports selectable collection methods, including ACLs, object properties, RDP, DCOM, and PS Remoting.
  • Offers DCOnly collection for methods that can be queried from a domain controller without connecting to member hosts.
  • Accepts password, NT hash, AES key, or Kerberos ticket-cache credentials.
  • Supports selecting a domain controller or Global Catalog when automatic detection is unsuitable.
  • Provides a Docker image for running the ingestor in a container.

Use Cases

  • A penetration tester can collect domain data during an authorized assessment and analyze it in BloodHound.
  • A security team can run focused collection, such as group membership or ACL enumeration, when a full sweep is unnecessary.
  • An assessor with limited connectivity to member servers can use DCOnly methods to gather domain-controller-accessible data.
  • A team can use the CE branch when its BloodHound deployment is Community Edition rather than the legacy versions supported by the default branch.

What you need

Detected in the repository

  • Python (from pyproject.toml)
  • A Dockerfile, so it can run in a container

License in plain words

MITpermissive

  • Commercial use: yes
  • Modify and redistribute: yes
  • You must keep: the copyright and license notice
  • Share your changes: no

A summary, not legal advice: the LICENSE file is what applies.

Getting Started

Install the legacy ingestor with:

pip install bloodhound

This adds bloodhound-python to your PATH. See the README for credentials, collection options, and CE installation details.

Considerations

  • The default branch supports BloodHound 4.2 and 4.3 only; CE requires the separate bloodhound-ce branch.
  • GPO local-group collection is not supported, although the README says other collection methods are implemented.
  • Recent activity consists of a few commits, with no release in over a year. Most contributions come from one person, and reported issue resolution is slow.
  • The project is MIT-licensed. Check the license terms when including it in a product or distribution.
  • The repository metadata does not indicate CI or a test suite, so teams should validate collection behavior in their own environment.

Found this useful?

Share it with someone who would like BloodHound.py.