# Conducting Internal Reconnaissance With Bloodhound Ce

Conduct internal Active Directory reconnaissance using BloodHound Community Edition to...

- Repository: https://github.com/AgentFlocks/flocks (504 stars)
- Category: Engineering
- License: Apache-2.0
- Last updated: 2026-10-30
- Runs scripts: yes, review before use

## Install

Claude Code: `npx skills add AgentFlocks/flocks --skill conducting-internal-reconnaissance-with-bloodhound-ce -g -a claude-code -y`
Codex: `npx skills add AgentFlocks/flocks --skill conducting-internal-reconnaissance-with-bloodhound-ce -g -a codex -y`
Cursor: `npx skills add AgentFlocks/flocks --skill conducting-internal-reconnaissance-with-bloodhound-ce -g -a cursor -y`
Gemini CLI: `npx skills add AgentFlocks/flocks --skill conducting-internal-reconnaissance-with-bloodhound-ce -g -a gemini-cli -y`

## Description

Conduct internal Active Directory reconnaissance using BloodHound Community Edition to map attack paths, identify privilege escalation chains, and discover misconfigurations in domain environments.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Conducting Internal Reconnaissance with BloodHound CE


> **Legal Notice:** This skill is for authorized security testing and educational purposes only. Unauthorized use against systems you do not own or have written permission to test is illegal and may violate computer fraud laws.

## Overview

BloodHound Community Edition (CE) is a modern, web-based Active Directory reconnaissance platform developed by SpecterOps that uses graph theory to reveal hidden relationships and attack paths within AD environments. Unlike the legacy BloodHound application, BloodHound CE uses a PostgreSQL backend with a dedicated graph database, providing improved performance, a modern web UI, and enhanced API capabilities. Red teams use BloodHound CE to collect AD objects, ACLs, sessions, group memberships, and trust relationships, then visualize attack paths from compromised low-privileged accounts to high-value targets like Domain Admins. The SharpHound collector (v2 for CE) gathers data from Active Directory, while AzureHound collects from Azure AD / Entra ID environments.


## When to Use

- When conducting security assessments that involve conducting internal reconnaissance with bloodhound ce
- When following incident response procedures for related security events
- When performing scheduled security testing or auditing activities
- When validating security controls through hands-on testing

## Prerequisites

- Familiarity with red teaming concepts and tools
- Access to a test or lab environment for safe execution
- Python 3.8+ with required dependencies installed
- Appropriate authorization for any testing activities

## Objectives

The rest: https://github.com/AgentFlocks/flocks/blob/HEAD/.flocks/flockshub/plugins/skills/Anthropic-Cybersecurity-Skills/conducting-internal-reconnaissance-with-bloodhound-ce/SKILL.md