You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
A curated list of BloodHound OpenGraph collectors, libraries, and tools that extend BloodHound's attack path mapping capabilities beyond Active Directory.
BloodHound CE introduced the OpenGraph feature, allowing anyone to ingest arbitrary graph data and query it alongside traditional AD/Azure objects. This list tracks the growing ecosystem of community-built collectors.
Maps access rights of network shares into BloodHound OpenGraphs. Enumerates SMB share permissions across the domain and surfaces attack paths via misconfigured ACLs.
Go (formerly PowerShell) collector by SpecterOps that maps MSSQL attack paths, linked-server chains, database permissions, and SQL-based lateral movement, into BloodHound via OpenGraph.
Enumerates privileged scheduled tasks on remote Windows systems and exposes them as BloodHound attack edges, revealing paths to high-value accounts via task execution.
BloodHound OpenGraph collector for user profiles stored on domain machines. Helps red teamers make informed decisions about targeting machines where high-value profiles are actively loaded.
Collects manager-subordinate relationships from AD and exports them as custom ManagerOf edges. Surfaces hidden privilege escalation paths in organisations where managers can reset subordinate passwords via self-service portals.
OpenGraph extension that exports arbitrary Active Directory custom attributes as BloodHound node properties, allowing organisations to enrich the graph with domain-specific metadata.
Defensive BloodHound OpenGraph collector for on-prem Microsoft Exchange. Maps mailbox delegation and Exchange privilege relationships to help blue teams identify abuse paths and permission risks.
BloodHound OpenGraph collector that models Windows local privilege escalation vectors (weak service permissions, unquoted paths, token abuse, etc.) as interconnected attack paths.
Maps lateral movement paths through misconfigured SSH services in Active Directory environments. Discovers Windows OpenSSH misconfigurations, authorized keys, and known hosts.
Small collector by SpecterOps that models abusable Entra ID Seamless Single Sign-On edges in BloodHound, exposing SSO-based authentication bypass paths.
Okta data collector for BloodHound CE. Maps Okta users, groups, applications, and policies to surface identity-based attack paths through Okta-managed resources.
BloodHound collector for FreeIPA and Red Hat Identity Management (IdM) environments. Enumerates users, groups, hosts, HBAC rules, and sudo policies to map Linux identity attack paths.
Advanced AD network topology analyzer with SMB validation and multiple auth methods (password/NTLM/Kerberos). Discovers hosts, subnets, and assets and exports them as BloodHound-compatible OpenGraph JSON.
Nmap collector example for the DataHound pipeline engine. Parses nmap XML output and injects hosts, ports, and services into BloodHound as an OpenGraph dataset.
Collects infrastructure and permissions data from VMware vCenter and exports it as a BloodHound-compatible graph using custom nodes and edges, mapping virtualisation-layer attack paths.
Google Cloud security attack path discovery tool. Enumerates GCP IAM bindings, service accounts, and resource hierarchies and models them as BloodHound attack paths.
GCP pentesting framework modelled after Pacu (for AWS). Provides enumeration, exploit, analysis, and download modules, with an OpenGraph generator for BloodHound-style analysis of GCP environments.
Pentesting tool for Oracle Cloud Infrastructure (OCI), enumeration, download, and graphical analysis. Includes an OpenGraph generator for BloodHound-style attack path analysis of OCI tenants.
Brings runZero Exposure Management data into BloodHound. Maps asset inventory, network exposure, and vulnerability data alongside identity paths for unified attack surface analysis.
BloodHound OpenGraph collector by SpecterOps for GitHub organisations. Models orgs, users, teams, repositories, branches, and role assignments as a navigable attack-path graph, ideal for access audits, compliance checks, and incident response.
Official SpecterOps GitHub collector built on the OpenHound framework. Next-generation Python implementation with a collect-first, convert-later pipeline.
Community Python reimplementation of the GitHound collector. Maintains feature parity with the PowerShell version for environments where Python is preferred.
Maps Salesforce attack paths in BloodHound by collecting profiles, roles, permission sets, and object-level access. Identifies paths to sensitive records or admin-level Salesforce access.
Salesforce identity and permission graph collector for BloodHound CE by NetSPI. Maps users, profiles, permission sets, roles, groups, sharing rules, connected apps, and field-level security into attack-path graphs.
BloodHound extension for Snowflake by SpecterOps. Maps Snowflake's RBAC model, users, roles, databases, warehouses, and integrations, to identify privilege escalation and attack paths within Snowflake tenants.
Python collector by SpecterOps that identifies attack paths in Jamf Pro tenants based on object permissions. Outputs data as JSON for BloodHound ingestion.
BloodHound OpenGraph extension for 1Password for Business by SpecterOps. Models accounts, users, groups, vaults, and items with edges covering view, manage, and recovery permissions to audit credential access paths.
Credential scanner for popular desktop AI platforms. Discovers credentials and tokens stored by AI assistants and models the resulting exposure as BloodHound attack edges.
Go-based BloodHound collector that discovers Linux and SSH attack paths. Enumerates local users, groups, sudo rules, SSH authorized keys, and running services. Outputs OpenGraph JSON and integrates with existing SharpHound and AzureHound data.
Go collector for adding Ansible AWX and Ansible Tower attack paths to BloodHound via OpenGraph. Maps inventories, playbooks, credentials, and role assignments to expose automation-based lateral movement paths.
Offensive toolkit and BloodHound graph creator for DPAPI blobs and master key files. Decrypts DPAPI-protected credentials and feeds the results into BloodHound to map credential-based attack paths.
Deception implementation driven by BloodHound data analysis. Generates convincing fake OpenGraph nodes and edges to plant honeypot paths, luring attackers and triggering alerts on reconnaissance activity.
Python automation tool for SOC teams. Aggregates threat intelligence from MITRE ATT&CK, Sigma rules, and Atomic Red Team and produces OpenGraph JSON for BloodHound ingestion, enabling analysts to visualise detection coverage and identify blind spots.
Official SpecterOps framework for building OpenGraph collectors. Built on DLT (Data Load Tool), it enforces a collect-first, convert-later pipeline, auto-generates CLI commands and graph documentation, and minimises boilerplate for new collector development.
Go library to create BloodHound OpenGraphs easily. Provides typed structs, builders, and HTTP helpers so developers can write custom collectors without dealing with raw JSON or API internals.
Python library for creating BloodHound OpenGraphs. Provides a high-level API for building nodes, edges, and graph payloads compatible with the BloodHound OpenGraph ingest endpoint.
OpenGraph-compatible JSON generator for BloodHound. Scrapes arbitrary data sources and outputs valid OpenGraph JSON, lowering the barrier to building custom collectors.
Advanced data pipeline engine for the BloodHound OpenGraph framework. Handles collection, transformation, and ingestion of arbitrary data sources at scale.
PowerShell client for the BloodHound API. Provides cmdlets for querying, managing nodes and edges, running Cypher, and automating BloodHound workflows from the command line.
Tool for managing custom node types and Cypher queries in BloodHound. Simplifies the creation, storage, and reuse of custom graph schemas and Cypher queries for OpenGraph datasets.
Contributing
PRs welcome! Please follow the format above, one row per tool with a concise description focused on what data is collected and what attack paths it surfaces.
