BloodHound
SpecterOps graph tool that maps Active Directory and Entra ID attack paths so testers can find and validate identity privilege paths in authorised assessments.
0 upvotes · 0 downvotes
- Category
- Offensive Security & Pentesting
- Pricing
- Free
- Platforms
- WebLinuxWindows
- Licence
- Open source
- Reviewed
- Last reviewed 1 October 2026
**What it is**
BloodHound is an identity attack-path analysis platform from SpecterOps. It uses graph theory to show how users, groups, computers and other objects connect in Active Directory and Entra ID (formerly Azure AD), including paths that can lead to highly privileged roles. BloodHound Community Edition (CE) is free and open source for point-in-time assessments. BloodHound Enterprise is a separate commercial SaaS focused on continuous attack-path management for defenders. From v8.0, OpenGraph can extend coverage beyond AD and Entra ID with custom collectors and a JSON schema.
**What it helps with**
- Collecting and ingesting directory relationship data (for example via SharpHound or AzureHound collectors).
- Visualising privilege paths from ordinary principals toward Tier Zero or other high-value targets.
- Finding abusable ACL, group nesting, Kerberos, ADCS and related identity conditions during authorised tests.
- Supporting red-team and purple-team walkthroughs of how an adversary might move through identity systems.
- Optionally extending graphs with OpenGraph data sources in hybrid environments.
- Pairing CE findings with BloodHound Enterprise where an organisation already licences continuous monitoring (optional; not required to use CE).
**Who it's for**
Penetration testers, red and purple teams, and identity-focused defenders who need to understand privileged relationships in Active Directory or Entra ID environments they are authorised to assess.
**Worth knowing**
Use BloodHound only on directories and tenants you are explicitly authorised to test. Collectors gather sensitive directory data; handle exports under engagement rules and data-protection requirements. BloodHound CE is free under the Apache 2.0 licence; BloodHound Enterprise is a separate paid SpecterOps product with continuous collection and remediation features. Official docs cover CE and Enterprise side by side. Attribution: product framing from bloodhound.specterops.io and specterops.io; licence from the SpecterOps/BloodHound repository.