Skip to main content
BloodHound maps the Active Directory environment as a graph of relationships — who can do what to whom. EtherReaper collects the raw data using netexec’s BloodHound collection module and saves the output as a zip archive ready for import.

​
Running a collection

Endpoint: POST /api/bloodhound/run Under the hood: Runs netexec ldap <dc_ip> -u <user> -p <pass> -d <domain> --bloodhound --collection All --dns-server <dc_ip>. For ccache authentication, targets the domain name instead of the IP and sets KRB5CCNAME. Request body: 
{
  "username": "jdoe",
  "password": "Password123",
  "domain": "corp.local",
  "use_kerberos": false,
  "use_kcache": false
}
FieldDescription
usernameDomain account for collection
passwordPassword or NTLM hash
domainTarget domain (auto-filled from Network Info)
use_kerberosPass -k to netexec; syncs clock with DC first
use_kcacheUse a ccache file from recon/ccache/
ccache_fileccache filename (required when use_kcache is true)
sudo_passwordRequired when using Kerberos for clock sync
DC hostname and IP are always sourced from Network Info — they are not settable per-request.
The collection uses --collection All, which gathers all available data categories in a single run. This is the recommended mode for comprehensive attack path analysis.

​
Output

Netexec writes BloodHound output to the current working directory as a timestamped zip archive. EtherReaper saves this to: 
recon/bloodhound_<domain>_<timestamp>.zip
The zip contains JSON files for each collection category.

​
What BloodHound data contains

CategoryDescription
UsersDomain user accounts with properties and group membership
GroupsSecurity groups and their members
ComputersDomain-joined machines with session and local admin data
SessionsWho is logged in where (current sessions)
ACLsAccess control relationships between objects
GPOsGroup Policy Objects and their links
OUsOrganizational unit structure and hierarchy
DomainsDomain objects and trust relationships
TrustsCross-domain and cross-forest trust configurations

​
Importing into BloodHound

1

Download the collection zip

Use GET /api/download-package to download a full EtherReaper data package, or retrieve the BloodHound zip directly from recon/.
2

Open BloodHound CE

Navigate to your BloodHound CE instance (default: http://localhost:8080 if running locally) and log in.
3

Upload the zip

Go to Administration → File Ingest and upload the bloodhound_*.zip file. BloodHound processes the JSON files and populates the Neo4j graph database.
4

Run queries

Use the built-in analysis queries (e.g. Find Shortest Paths to Domain Admins) or the Cypher query interface to explore attack paths.
BloodHound CE requires its own Neo4j instance. If you are running a legacy BloodHound (4.x) with a standalone Neo4j database, import via the Upload Data button in the BloodHound GUI instead.

​
Downloading output

Endpoint: GET /api/download-package Downloads a zip archive of the entire data/ and recon/ directories — including the BloodHound collection zip, all scan output files, and the SQLite database. Use this for offline analysis or to transfer results to a reporting system.

​
Authentication notes

Standard username and password. If the password field contains an NTLM hash (LM:NT or :<NT>), EtherReaper automatically passes -H instead of -p.
Appends -k to the netexec command. Clock sync with the DC is performed automatically before the scan using ntpdate (requires sudo password).
Sets KRB5CCNAME to the selected ccache path, parses the username and domain from the ccache file, syncs time, and runs netexec ldap <domain> -u <user> --use-kcache --bloodhound ... targeting the domain name rather than the DC IP.

​
Typical workflow

BloodHound collection is most useful once you have an initial foothold. A typical sequence:
1

Obtain credentials

Use Responder, ASRepCatcher, or a Kerberoast/AS-REP Roast hit to obtain valid domain credentials or a ccache.
2

Run BloodHound collection

Submit POST /api/bloodhound/run with your credentials. The collection takes 30–120 seconds depending on domain size.
3

Import and analyze

Import the zip into BloodHound CE. Run Shortest Paths to Domain Admins to identify privilege escalation paths.
4

Act on findings

Use paths involving delegation, ADCS misconfiguration, or ACL abuse to escalate. Run the relevant EtherReaper modules (Delegation, ADCS, Kerberoast) to execute.

Build docs developers (and LLMs) love

Get started for freeTalk to us