AD-PathFinder
Attack path mapping for Active Directory, ADCS, SCCM, and MSSQL using BloodHound CE + OpenGraph data.
File Explorer
Download Latest Version (.zip)- test.yml
- dependabot.yml
- chart.min.js
- report.js
- report_styles.css
- __init__.py
- base.py
- escalation.py
- group_analysis.py
- shared_graph_paths.py
- simple.py
- __init__.py
- admin_paths.py
- admin_privileges.py
- admin_rights_helper.py
- base.py
- constants.py
- data_access.py
- datasource.py
- dependencies.py
- high_value.py
- manager.py
- mssql_common.py
- platform_mixins.py
- registry.py
- shared_password.py
- sid_mapper.py
- weak_password.py
- __init__.py
- admin_weak_crossdomain.py
- base.py
- cracked_password_reuse.py
- cross_domain_computer_escalation_path.py
- cross_domain_escalation_path.py
- domain_trusts.py
- injector.py
- manager.py
- same_user_password.py
- __init__.py
- account_shared_password.py
- adcs_base.py
- admin_weak_password.py
- asrep_roastable_admin_weak.py
- bad_successor.py
- builtin_group_escalation.py
- common_group_escalation.py
- computer_admin_rights.py
- computer_constrained_delegation.py
- computer_unconstrained_delegation.py
- computer_weak_password.py
- computers_with_escalation_path.py
- esc1_vulnerable_template.py
- esc2_any_purpose.py
- esc3_enrollment_agent.py
- esc3_victim_template.py
- esc4_template_acl.py
- esc6_user_specifies_san.py
- esc6a_user_specifies_san.py
- esc7_ca_permissions.py
- esc8_vulnerable_ca.py
- esc9_no_security_extension.py
- group_analysis_base.py
- kerberoastable_admin_weak.py
- krbtgt_password_age.py
- mssql_impersonation.py
- mssql_linked_servers.py
- mssql_logins.py
- mssql_ntlm_relay.py
- mssql_privilege_escalation.py
- non_admin_asrep_roastable_weak.py
- non_admin_computer_rights.py
- non_admin_kerberoastable_weak.py
- non_admin_weak_password.py
- sccm_anon_policy.py
- sccm_elevate1.py
- sccm_privilege_escalation.py
- sccm_pxe_dp.py
- sccm_takeover1.py
- sccm_takeover2.py
- sccm_takeover4.py
- sccm_takeover5.py
- sccm_takeover6.py
- sccm_takeover7.py
- sccm_takeover8.py
- smb_signing.py
- smb_signing_with_path.py
- tier0_session_exposure.py
- user_constrained_delegation.py
- user_unconstrained_delegation.py
- user_weak_password_constrained_delegation.py
- user_weak_password_unconstrained_delegation.py
- users_with_escalation_path.py
- webclient_with_path.py
- __init__.py
- mssql.py
- sccm.py
- ad-report-slideshow-poster.png
- ad-report-slideshow.gif
- ad-report-slideshow.mp4
- ad-report-slideshow.webp
- adpathfinder-blog-hero-v3.webp
- adpathfinder-opengraph-chain.svg
- demo-slideshow-poster.png
- demo-slideshow.gif
- demo-slideshow.mp4
- demo-slideshow.webp
- password-audit-slideshow-poster.png
- password-audit-slideshow.gif
- password-audit-slideshow.mp4
- password-audit-slideshow.webp
- workflow.svg
- demo.tape
- demo_show.sh
- OPENGRAPH.md
- __init__.py
- mssqlhound.py
- sharphound.py
- __init__.py
- account_analysis.py
- account_display.py
- account_escalation.py
- analysis.py
- audit_context.py
- BloodhoundImporter.py
- client_report_generator.py
- config_loader.py
- config_manager.py
- diagnostics.py
- domain_filter.py
- edge_glossary.py
- html_cross_domain.py
- html_json.py
- html_password_audit.py
- html_policy_compliance.py
- html_report_generator.py
- html_user_account.py
- hv_groups.py
- main.py
- mssql_post_import.py
- neo4j_connection.py
- neo4j_data.py
- neo4j_escalation.py
- neo4j_groups.py
- node_type_cache.py
- opengraph_collectors.py
- opengraph_contracts.py
- opengraph_identifiers.py
- policy_compliance.py
- relationships.py
- report_json.py
- report_stats.py
- reporting.py
- sanitizer.py
- secret.py
- shared_powershell.py
- user_query.py
- utils.py
- ConfigManBearPig.zip
- hashcat.potfile
- MSSQLHound.zip
- ntds.txt
- README.md
- SharpHound.zip
- training.local_AD_report.html
- training.local_domain_audit.txt
- training.local_password_audit.html
- training.local_password_audit.txt
- __init__.py
- test_admin_weak_crossdomain.py
- test_cracked_password_reuse.py
- test_cross_domain_computer_escalation_path.py
- test_cross_domain_escalation_path.py
- test_domain_trusts.py
- test_same_user_password.py
- __init__.py
- test_account_shared_password.py
- test_admin_weak_password.py
- test_asrep_roastable_admin_weak.py
- test_bad_successor.py
- test_builtin_group_escalation.py
- test_common_group_escalation.py
- test_computer_admin_rights.py
- test_computer_constrained_delegation.py
- test_computer_unconstrained_delegation.py
- test_computer_weak_password.py
- test_computers_with_escalation_path.py
- test_esc1_vulnerable_template.py
- test_esc2_any_purpose.py
- test_esc3_enrollment_agent.py
- test_esc3_victim_template.py
- test_esc4_template_acl.py
- test_esc6_user_specifies_san.py
- test_esc6a_user_specifies_san.py
- test_esc7_ca_permissions.py
- test_esc8_vulnerable_ca.py
- test_esc9_no_security_extension.py
- test_kerberoastable_admin_weak.py
- test_krbtgt_password_age.py
- test_manager_smoke.py
- test_mssql_impersonation.py
- test_mssql_linked_servers.py
- test_mssql_logins.py
- test_mssql_ntlm_relay.py
- test_mssql_privilege_escalation.py
- test_non_admin_asrep_roastable_weak.py
- test_non_admin_computer_rights.py
- test_non_admin_kerberoastable_weak.py
- test_non_admin_weak_password.py
- test_sccm_anon_policy.py
- test_sccm_elevate1.py
- test_sccm_privilege_escalation.py
- test_sccm_pxe_dp.py
- test_sccm_takeover1.py
- test_sccm_takeover2.py
- test_sccm_takeover4.py
- test_sccm_takeover5.py
- test_sccm_takeover6.py
- test_sccm_takeover7.py
- test_sccm_takeover8.py
- test_smb_signing.py
- test_smb_signing_with_path.py
- test_tier0_session_exposure.py
- test_user_constrained_delegation.py
- test_user_unconstrained_delegation.py
- test_user_weak_password_constrained_delegation.py
- test_user_weak_password_unconstrained_delegation.py
- test_users_with_escalation_path.py
- test_webclient_with_path.py
- account_shared_password.cypher
- admin_weak_password.cypher
- asrep_roastable_admin_weak.cypher
- bad_successor.cypher
- bad_successor_fallback_names.cypher
- bad_successor_foreign_dc.cypher
- builtin_group_escalation.cypher
- builtin_group_escalation_sccm_site.cypher
- common_group_escalation.cypher
- computer_admin_rights.cypher
- computer_constrained_delegation.cypher
- computer_unconstrained_delegation.cypher
- computer_weak_password.cypher
- computers_with_escalation_path.cypher
- cross_domain_computer_escalation_path.cypher
- cross_domain_computer_escalation_path_via_trust.cypher
- cross_domain_escalation_path.cypher
- cross_domain_escalation_path_via_trust.cypher
- dedupe_mssql_servers.cypher
- domain_trusts.cypher
- esc1_vulnerable_template.cypher
- esc1_vulnerable_template_manager_approval.cypher
- esc2_any_purpose.cypher
- esc3_enrollment_agent.cypher
- esc3_enrollment_agent_manager_approval.cypher
- esc3_victim_disjoint_acl.cypher
- esc3_victim_mixed_acl.cypher
- esc3_victim_no_agent.cypher
- esc3_victim_template.cypher
- esc4_template_acl.cypher
- esc6_user_specifies_san.cypher
- esc6_user_specifies_san_manager_approval.cypher
- esc6a_user_specifies_san.cypher
- esc7_ca_permissions.cypher
- esc8_vulnerable_ca.cypher
- esc9_no_security_extension.cypher
- esc9_no_security_extension_auth_disabled.cypher
- kerberoastable_admin_weak.cypher
- krbtgt_password_age.cypher
- mssql_impersonation.cypher
- mssql_impersonation_branched.cypher
- mssql_linked_servers.cypher
- mssql_logins.cypher
- mssql_ntlm_relay.cypher
- mssql_ntlm_relay_no_target.cypher
- mssql_priv_esc_group_owned_login.cypher
- mssql_priv_esc_linked_server_empty_stub.cypher
- mssql_priv_esc_linked_server_name_overmatch.cypher
- mssql_priv_esc_owns_server_role.cypher
- mssql_privilege_escalation.cypher
- mssql_privilege_escalation_linked_server.cypher
- non_admin_asrep_roastable_weak.cypher
- non_admin_computer_rights.cypher
- non_admin_kerberoastable_weak.cypher
- non_admin_weak_password.cypher
- sccm_anon_policy.cypher
- sccm_elevate1.cypher
- sccm_priv_esc_linked_server_empty_stub.cypher
- sccm_priv_esc_linked_server_name_overmatch.cypher
- sccm_privilege_escalation.cypher
- sccm_pxe_dp.cypher
- sccm_takeover1.cypher
- sccm_takeover1_source_filter.cypher
- sccm_takeover2.cypher
- sccm_takeover4.cypher
- sccm_takeover5.cypher
- sccm_takeover6.cypher
- sccm_takeover6_colocated.cypher
- sccm_takeover7.cypher
- sccm_takeover7_disabled_host.cypher
- sccm_takeover8.cypher
- smb_signing.cypher
- smb_signing_with_path.cypher
- tier0_session_exposure.cypher
- tier0_session_exposure_tier0_computer.cypher
- user_constrained_delegation.cypher
- user_unconstrained_delegation.cypher
- user_weak_password_constrained_delegation.cypher
- user_weak_password_unconstrained_delegation.cypher
- users_with_escalation_path.cypher
- webclient_with_path.cypher
- __init__.py
- test_pipeline_fingerprint.py
- __init__.py
- check_harness.py
- conftest.py
- README.md
- test_adcs_commands.py
- test_audit_context.py
- test_check_inventory.py
- test_collector_manifests.py
- test_common_group_threshold.py
- test_config_loader.py
- test_credential_handling.py
- test_cross_domain_label_filtering.py
- test_datasource_abstraction.py
- test_diagnostics.py
- test_discovery_smoke.py
- test_display_spacing.py
- test_domain_filtering.py
- test_empty_pattern_guard.py
- test_ensure_exclusions_section.py
- test_escalation_batch_diagnostics.py
- test_escalation_priority.py
- test_group_label_filtering.py
- test_html_sidebar_invariants.py
- test_import_detection.py
- test_importer_dedupe_neo4j.py
- test_importer_opengraph.py
- test_importer_zip_slip.py
- test_instrumented_connection.py
- test_manager_hardening.py
- test_neo4j_data_caching.py
- test_neo4j_fixture_config.py
- test_node_type_cache.py
- test_opengraph_contracts.py
- test_password_hash_handling.py
- test_platform_privilege_filtering.py
- test_policy_compliance_length.py
- test_relationship_cache_prewarm.py
- test_removed_privileged_account_state.py
- test_report_label_filtering.py
- test_secret.py
- test_shared_graph_paths_display.py
- test_single_domain_routing.py
- test_suppress_subordinate_sql_roles.py
- .gitignore
- adpathfinder.py
- LICENSE
- pyproject.toml
- README.md
- requirements.txt
// repository documentation
Was this content helpful?
(0 ratings)