> For the complete documentation index, see [llms.txt](https://notes.cavementech.com/pentesting-quick-reference/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://notes.cavementech.com/pentesting-quick-reference/active-directory-pentesting/active-directory/bloodhound/analyzing-attack-paths.md).
# Analyzing Attack Paths
## Analyzing Attack Paths
Once your data is loaded into BloodHound, the real fun begins. The graphical user interface allows you to step away from command-line outputs and visually track how an attacker moves laterally across a network.
### Adding the Data to BloodHound
1. Click the "Quick Upload" button on the left panel.
3. Select any of the .zip or .json files generated in the previous task and upload them. It will take a minute or two to ingest the data. You can monitor this by clicking Administration -> File Ingest
5. When it says "Complete" you are ready to start analyzing attack paths.
### Built-In Queries
Instead of forcing you to write complex graph database queries (written in a language called Cypher). Navigate to Explore -> CYPHER to see the queries
A few important queries are below:
* **Paths from Domain Users to Tier Zero / High Value Targets:** This is the primary offensive query. It traces every known relationship from lower-privileged entities to the highest tier of administrative control.
* **Shortest paths to Domain Admins:** This targets the shortest path to compromise a Domain Admin account (this would lead to full domain compromise).
* **Find AS-REP Roastable / Kerberoastable Users:** Instantly highlights accounts vulnerable to offline credential cracking attacks.
When you click one of these queries, BloodHound dynamically draws a map showing your targets on the right and the vulnerable starting points on the left.
The image above is an example of a query, don't worry about interpreting each edge for now.
### Understanding User Nodes
The graph view isn't just a static picture; every single node (the circles representing Users, Computers, and Groups) can be clicked to open a wealth of contextual information in the Node Info panel.
When you click on a User Node, the side panel populates several tabs packed with valuable intelligence.
* **Is Domain Admin / Is High Value:** A quick indicator of the account's tiering status.
* **Password Last Set / Last Logon:** Critical for identifying active vs. stale/abandoned accounts that might be easier targets.
* **Enabled:** Confirms whether the account is active or disabled.
* **Group Membership:** If a user belongs to a group that belongs to another group, BloodHound resolves this "nested" inheritance automatically (something that is notoriously difficult to track manually).
#### Outbound Object Control
Outbound Object Control shows you what a user can do. This tab is arguably the most critical section for defenders looking to secure an environment, as well as for attackers looking to escalate privileges.
Active Directory uses Access Control Lists (ACLs) to dictate who can modify what. Over time, these permissions become incredibly messy. When you click this tab, BloodHound reveals every object that the selected node has explicit control over.
You can even click one of the Edges to understand the potential attack path.
* **Defenders:** This is how you find misconfigurations before attackers do. If a standard HelpDesk tier user has `GenericAll` (full control) over a Domain Controller or a highly privileged service account, that is a critical vulnerability.
* **Attackers:** This reveals your next target. If you compromise a user, you check their Outbound Object Control. If they have the `ForceChangePassword` right over an IT Admin's account, you can simply overwrite that admin's password and take over their account. Of course, in a real engagement, you should receive permission from the client before changing passwords.