BloodHound
What it’s for
Maps Active Directory relationships and shows attack paths to high-value targets like Domain Admin, as a graph.
Where it shines
- Turns a confusing domain setup into an easy visualisation.
- Finds paths that would suck to enumerate manually.
Where it falls down
- Collection methods don't always give you the full picture.
- The Query section takes some learning to understand.
My take
Bloodhound, I think, is an essential tool for AD testing. It has helped me at least twice get domain admin that I wouldn't have found in the allowed timeframe. Honestly a top 10 tool for me.