SpecterOps / BloodHound

Six Degrees of Domain Admin

lefayjey / linWinPwn

linWinPwn is a bash script that streamlines the use of a number of Active Directory tools

SpecterOps / SharpHound

C# Data Collector for BloodHound

SpecterOps / AzureHound

Azure Data Exporter for BloodHound

ADScanPro / adscan

Free Active Directory pentesting tool for Linux, macOS and Windows. Automates AD and LDAP enumeration, Kerberoasting, ASREPRoast, password spraying, ADCS/ESC1, DCSync, RBCD, gMSA, shadow credentials, NTLM relay and credential dumping across 104 techniques, mapping BloodHound-compatible attack paths to Domain Admin. NIS2 / ISO 27001 reports.

g0h4n / RustHound-CE

Active Directory data ingestor for BloodHound Community Edition written in Rust. 🦀

dazzyddos / PrivHound

A BloodHound OpenGraph collector that models Windows local privilege escalation as interconnected attack paths.

ADScanPro / Claude-AD

Active Directory pentest methodology for Claude Code: skills, agents and slash commands for internal AD red-team work (Kerberoasting, ADCS ESC1-17, DCSync, ACL abuse, NTLM relay, delegation), with per-technique OPSEC/telemetry notes. Drives netexec, impacket, certipy, bloodyAD, BloodHound CE.

Noz2 / RootHound

Map your path from a low-priv user to roo, like BloodHound, for local Linux privesc.

An0nUD4Y / bloodhound-ldapx.py

Modified BloodHound.py CE ingestor for red team use. Obfuscates LDAP through ldapx, paces LDAP searches and host RPC, and resumes a stopped collection. Writes BloodHound CE JSON.

AWSHound / AWSHound

AWS Bloodhound OpenGraph Connector

warpedatom / NoiseHound

Detection-aware BloodHound attack-path scoring - the quietest route to your objective, calibrated across five detection tiers (audit/EDR/Elastic/MDI/WDAC) plus Azure.

crypt0p3g / adexview

Browse, search and audit AD Explorer snapshots offline in your browser: decoded attributes, LDAP filters, and reports for what BloodHound doesn't show (DNS, subnets, DFS, GPO links, LAPS, AD CS).

M-med / Active-Directory-Simulation-Attack-

A Purple Team lab simulating Active Directory attacks (Kerberoasting, BloodHound, lateral movement) and implementing defensive hardening (gMSA, tiering, LLMNR/NetBIOS disabling) with Wazuh SIEM detection rules mapped to MITRE ATT&CK.