RustHound-CE Collector
Faster Rust-based BloodHound CE collector. Single static binary, ideal when Python isn't available or LDAP queries need to be quick on large domains.
- Tool
- rusthound-ce
- Category
- Enumeration / BloodHound Cypher Queries
- Platform
- cross-platform
- Requires
- password
- Protocols
- LDAP
Syntax
Angle-bracket tokens are placeholders — replace them with your target's values, or open this command in the app to fill them in and copy the result.
rusthound-ce -d '<domain>' -u '<user>@<domain>' -p '<password>' -z
Credential variants
The same attack using a different authentication material.
LDAPS requires password
rusthound-ce -d '<domain>' -u '<user>@<domain>' -p '<password>' --ldaps -z
Examples
rusthound-ce -d corp.local -u jdoe@corp.local -p 'Password123!' -z
Tags
References
Related commands
- BloodHound.py CE Collector Collect AD data into the BloodHound Community Edition JSON format from Linux. Use --zip…
- Cypher: ADCS ESC1 Candidates (Certipy BloodHound) List every user that can enroll in an ESC1-vulnerable certificate template (enrollee…
- Cypher: All Paths from Owned to High-Value All shortest paths from any owned principal to any high-value target (Domain Admins,…
- Cypher: AS-REP Roastable Users List every user with DONT_REQ_PREAUTH set — these accounts can be AS-REP roasted without…
- Cypher: Kerberoastable Users List every kerberoastable user in the domain (has a SPN, not krbtgt). Pair with hasLAPS…
- Cypher: Principals With DCSync Rights Find every principal that holds DS-Replication-Get-Changes /…
- Cypher: RBCD Write Targets Surface every account that can write to a computer object — the precondition for…
- Cypher: Shortest Path to Domain Admins Find the shortest attack path from any owned user to the Domain Admins group. The…