{"id":13598945,"url":"https://github.com/davidprowe/BadBlood","last_synced_at":"2025-04-10T10:30:42.429Z","repository":{"id":39567585,"uuid":"234358461","full_name":"davidprowe/BadBlood","owner":"davidprowe","description":"BadBlood by @davidprowe, Secframe.com, fills a Microsoft Active Directory Domain with a structure and thousands of objects. The output of the tool is a domain similar to a domain in the real world.  After BadBlood is ran on a domain, security analysts and engineers can practice using tools to gain an understanding and prescribe to securing Active Directory. Each time this tool runs, it produces different results.  The domain, users, groups, computers and permissions are different. Every. Single. Time.","archived":false,"fork":false,"pushed_at":"2023-06-07T17:14:17.000Z","size":666,"stargazers_count":2112,"open_issues_count":9,"forks_count":283,"subscribers_count":47,"default_branch":"master","last_synced_at":"2025-04-07T23:01:39.630Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"https://www.secframe.com/badblood","language":"PowerShell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/davidprowe.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":".github/FUNDING.yml","license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null},"funding":{"github":"davidprowe","patreon":null,"open_collective":null,"ko_fi":null,"tidelift":null,"community_bridge":null,"liberapay":null,"issuehunt":null,"otechie":null,"lfx_crowdfunding":null,"custom":null}},"created_at":"2020-01-16T16:08:54.000Z","updated_at":"2025-04-06T17:35:17.000Z","dependencies_parsed_at":"2024-01-05T23:57:16.256Z","dependency_job_id":"3048bbd4-f888-42bf-bee7-7460aa5f0bf5","html_url":"https://github.com/davidprowe/BadBlood","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/davidprowe%2FBadBlood","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/davidprowe%2FBadBlood/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/davidprowe%2FBadBlood/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/davidprowe%2FBadBlood/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/davidprowe","download_url":"https://codeload.github.com/davidprowe/BadBlood/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248199136,"owners_count":21063641,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-01T17:00:58.337Z","updated_at":"2025-04-10T10:30:42.404Z","avatar_url":"https://github.com/davidprowe.png","language":"PowerShell","readme":"BadBlood\n========\nBadBlood by Secframe fills a Microsoft Active Directory Domain with a structure and thousands of objects. The output of the tool is a domain similar to a domain in the real world.  After BadBlood is ran on a domain, security analysts and engineers can practice using tools to gain an understanding and prescribe to securing Active Directory. Each time this tool runs, it produces different results.  The domain, users, groups, computers and permissions are different. Every. Single. Time.\n\n- [Full User Guide and Info](https://www.secframe.com/badblood/)\n\n\u003cimg src=\"https://cdn2.hubspot.net/hubfs/3896789/SecFrame/BadBlood/BadBlood%20Icon.png\" width=50% alt=\"BadBlood Icon\"\u003e\n\n# Commands\n\n- `NONE`: At this time all items of the script are configured in the .ps1 files.  Files are outlined on the User Guide on [Secframe.com](https://www.secframe.com/badblood/)\n\n\n## Acknowledgments\n\nI'd like to send thanks to the countless people who wanted this as a product and waited while I made it!\n\n\n# Screenshots\n\n\u003cimg src=\"https://cdn2.hubspot.net/hubfs/3896789/SecFrame/BadBlood/BadBlood%20Intro.png\" width=100% alt=\"BadBlood Intro\"\u003e\n\u003cimg src=\"https://cdn2.hubspot.net/hubfs/3896789/SecFrame/BadBlood/badblood1.png\" alt=\"badblood start screen\"\u003e\n\u003cimg src=\"https://cdn2.hubspot.net/hubfs/3896789/SecFrame/BadBlood/badblood2.png\" alt=\"Findings\"\u003e\n\u003cimg src=\"https://cdn2.hubspot.net/hubfs/3896789/SecFrame/BadBlood/badblood4.png\" alt=\"IAM report\"\u003e\n\u003cimg src=\"https://cdn2.hubspot.net/hubfs/3896789/SecFrame/BadBlood/Every%20Single%20Time.png\" alt=\"BadBlood Every Single Time\"\u003e\n\u003cimg src=\"https://cdn2.hubspot.net/hubfs/3896789/SecFrame/BadBlood/badblood5_bloodhoundimport.png\" alt=\"Sample Bloodhound Sample After Badblood\"\u003e\n\n\n\n## Installation\n\nRequirements:\n- Domain Admin and Schema Admin permissions\n- Active Directory Powershell Installed\n\nRunning On Windows:\n```\n# clone the repo\ngit clone https://github.com/davidprowe/badblood.git\n#Run Invoke-badblood.ps1\n./badblood/invoke-badblood.ps1\n```\n\n# Talk About the BadBlood\n\n1. Message or Follow me on twitter @ davidprowe\n2. Drop a note on secframe.com\n3. I am not responsible for cleanup if this is run in a production domain\n\n## License\nThis project is licensed under the gplv3 License - see the LICENSE.md file for details\n\n## Disclaimer\nPlease note: all tools/ scripts in this repo are released for use \"AS IS\" without any warranties of any kind, including, but not limited to their installation, use, or performance. We disclaim any and all warranties, either express or implied, including but not limited to any warranty of noninfringement, merchantability, and/ or fitness for a particular purpose. We do not warrant that the technology will meet your requirements, that the operation thereof will be uninterrupted or error-free, or that any errors will be corrected.\n\nAny use of these scripts and tools is at your own risk. There is no guarantee that they have been through thorough testing in a comparable environment and we are not responsible for any damage or data loss or time loss incurred with their use.\n\nYou are responsible for reviewing and testing any scripts you run thoroughly before use in any non-testing environment.  This tool is not designed for a production environment.\n\n\n","funding_links":["https://github.com/sponsors/davidprowe"],"categories":["PowerShell","Tools","PowerShell (153)","Pre-built Cyber Range Environments and Content","Windows","Operating Systems","Lab Setup"],"sub_categories":["Containers","Windows","Misc Hardware Tools"],"project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdavidprowe%2FBadBlood","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fdavidprowe%2FBadBlood","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdavidprowe%2FBadBlood/lists"}