Domain Enumeration with Bloodhound

Using Bloodhound

To run Bloodhound, you must setup and run the neo4j console first:

sudo neo4j console
# Password: neo4j1

Setup and run Bloodhound and sign in using neo4j credentials:

sudo bloodhound

Now, setup the ingestor related to bloodhouhnd:

bloodhound-python -d <domain-name>.local -u <username> -p <password> -ns <dc-ip-address> -c all
# -u example: fcastle
# -p example: Password of fcastle
# -ns is for name server.

Upload files to bloodhound

Make a directory

bloodhound-python dumps a lot of files, so it’s better to make a directory and cd into it.