BloodHound

v5.13.0SpecterOps

Collectors (SharpHound, bloodhound-python) enumerate AD objects; the BloodHound UI graphs privilege-escalation paths. The range's collectors read the authored AD estate and produce the JSON zip the UI expects.

Category: Post-exploitation & lateral movement
Package: bloodhound
Runs on: Linux · Windows
Commands: bloodhound, bloodhound-python, sharphound
Console: https://bloodhound.range.local:8080

Reads authored AD objects and prints the graph the scenario models. No LDAP query leaves the browser.

Install it

The scripts below install the real SpecterOps package on your own machine — read them first, and run them somewhere you are allowed to change. Inside the range, one press puts the simulated package on your next machine.

Linux installer (shell script)

install-bloodhound.sh

Windows installer (PowerShell)

Install-bloodhound.ps1

On a range machine

Add it to your kit and every machine you launch comes with it.

On Linux

Debian, Ubuntu, Kali (apt)

Refresh the package lists
```
sudo apt update
```
Install BloodHound
```
sudo apt install -y bloodhound
```

RHEL, Fedora (dnf)

Install BloodHound
```
sudo dnf install -y bloodhound
```
Package names drift between distributions; search first if this one misses.

Arch (pacman)

Install BloodHound
```
sudo pacman -S --noconfirm bloodhound
```

Alpine (apk)

Install BloodHound
```
sudo apk add bloodhound
```
Package names drift between distributions; search first if this one misses.

Check it worked

Confirm it landed on PATH
```
which bloodhound
```
Check the version
```
bloodhound --version
```
The range reports 5.13.0.

Remove it

Take it off again
```
sudo apt remove --purge bloodhound
```

On Windows

Windows Package Manager (winget)

Search the catalog
```
winget search bloodhound
```
Install BloodHound
```
winget install --id bloodhound -e
```
Package names drift between distributions; search first if this one misses.

Chocolatey (choco)

Install BloodHound
```
choco install bloodhound -y
```
Run the shell as administrator.

Check it worked

Confirm it resolves
```
where bloodhound
```
Check the version
```
bloodhound --version
```
The range reports 5.13.0.

Remove it

Take it off again
```
winget uninstall --id bloodhound
```

Inside the range

Tick it on the launch screen
Under BloodHound's category on the advanced tool shelf. A lab that depends on it locks the toggle on and says why.
Or install it from a range terminal
```
sudo apt install -y bloodhound
```
The simulated package manager seeds the same binaries, config and receipt the shelf toggle does.
Everything here is simulated
No software is downloaded and nothing executes — the range answers from authored fixtures.

Labs that use BloodHound

Pentest: Read the AD Attack GraphUse the /pentest/attack-graph view to spot the shortest path from a helpdesk account to Domain Admin, walk it end-to-end with the simulated Kerberoast/DCSync tools, and file the delegation finding.