{"id":13845249,"url":"https://github.com/fortalice/bofhound","last_synced_at":"2026-01-15T00:35:14.347Z","repository":{"id":37641076,"uuid":"490801519","full_name":"fortalice/bofhound","owner":"fortalice","description":"Generate BloodHound compatible JSON from logs written by ldapsearch BOF, pyldapsearch and Brute Ratel's LDAP Sentinel","archived":false,"fork":false,"pushed_at":"2024-02-23T15:36:24.000Z","size":850,"stargazers_count":350,"open_issues_count":1,"forks_count":60,"subscribers_count":3,"default_branch":"main","last_synced_at":"2025-07-12T01:32:29.124Z","etag":null,"topics":["active-directory","bloodhound","bloodhoundad","ldap-query","ldapsearch"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"bsd-4-clause","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/fortalice.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2022-05-10T17:41:53.000Z","updated_at":"2025-07-10T12:00:44.000Z","dependencies_parsed_at":"2024-02-23T16:40:10.769Z","dependency_job_id":"54d3af9d-0901-436d-b22e-f2d0914c9464","html_url":"https://github.com/fortalice/bofhound","commit_stats":null,"previous_names":[],"tags_count":4,"template":false,"template_full_name":null,"purl":"pkg:github/fortalice/bofhound","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/fortalice%2Fbofhound","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/fortalice%2Fbofhound/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/fortalice%2Fbofhound/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/fortalice%2Fbofhound/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/fortalice","download_url":"https://codeload.github.com/fortalice/bofhound/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/fortalice%2Fbofhound/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":28439777,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-01-15T00:34:46.850Z","status":"ssl_error","status_checked_at":"2026-01-15T00:34:46.551Z","response_time":107,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["active-directory","bloodhound","bloodhoundad","ldap-query","ldapsearch"],"created_at":"2024-08-04T17:03:17.536Z","updated_at":"2026-01-15T00:35:14.327Z","avatar_url":"https://github.com/fortalice.png","language":"Python","funding_links":[],"categories":["Python","Unofficial Data Collectors"],"sub_categories":[],"readme":"# THIS REPO IS NO LONGER ACTIVE\n⛔🚧 This repo is no longer maintained. To submit an issue, pull request, or obtain the lastest version, reference [https://github.com/coffeegist/bofhound](https://github.com/coffeegist/bofhound) 🚧⛔\n```\n _____________________________ __    __    ______    __    __   __   __   _______\n|   _   /  /  __   / |   ____/|  |  |  |  /  __  \\  |  |  |  | |  \\ |  | |       \\\n|  |_)  | |  |  |  | |  |__   |  |__|  | |  |  |  | |  |  |  | |   \\|  | |  .--.  |\n|   _  \u003c  |  |  |  | |   __|  |   __   | |  |  |  | |  |  |  | |  . `  | |  |  |  |\n|  |_)  | |  `--'  | |  |     |  |  |  | |  `--'  | |  `--'  | |  |\\   | |  '--'  |\n|______/   \\______/  |__|     |__|  |___\\_\\________\\_\\________\\|__| \\___\\|_________\\\n\n                              by Fortalice ✪\n```\n\n# BOFHound\n\nBOFHound is an offline BloodHound ingestor and LDAP result parser compatible with TrustedSec's [ldapsearch BOF](https://github.com/trustedsec/CS-Situational-Awareness-BOF), the Python adaptation, [pyldapsearch](https://github.com/fortalice/pyldapsearch) and Brute Ratel's [LDAP Sentinel](https://bruteratel.com/tabs/commander/badgers/#ldapsentinel).\n\nBy parsing log files generated by the aforementioned tools, BOFHound allows operators to utilize BloodHound's beloved interface while maintaining full control over the LDAP queries being run and the spped at which they are executed. This leaves room for operator discretion to account for potential honeypot accounts, expensive LDAP query thresholds and other detection mechanisms designed with the traditional, automated BloodHound collectors in mind.\n\n[Blog - Granularize Your AD Recon Game](https://www.fortalicesolutions.com/posts/bofhound-granularize-your-active-directory-reconnaissance-game)\n\n[Blog - Granularize Your AD Recon Game Part 2](https://www.fortalicesolutions.com/posts/granularize-your-active-directory-reconnaissance-game-part-2)\n\n# Installation\nBOFHound can be installed with `pip3 install bofhound` or by cloning this repository and running `pip3 install .`\n\n# Usage\n![](.assets/usage.png)\n\n\n## Example Usage\nParse ldapseach BOF results from Cobalt Strike logs (`/opt/cobaltstrike/logs` by default) to /data/\n```\nbofhound -o /data/\n```\n\nParse pyldapsearch logs and only include all properties (vs only common properties)\n```\nbofhound -i ~/.pyldapsearch/logs/ --all-properties\n```\n\nParse LDAP Sentinel data from BRc4 logs (will change default input path to `/opt/bruteratel/logs`)\n```\nbofhound --brute-ratel\n```\n\n# ldapsearch\n\n## Required Data\nThe following attributes are required for proper functionality:\n\n```\nsamaccounttype\ndn\nobjectsid\n```\n\n## Example ldapsearch Queries\nGet All the Data (Maybe Run BloodHound Instead?)\n```\nldapsearch (objectclass=*) *,ntsecuritydescriptor\n```\n\nRetrieve All Schema Info\n```\nldapsearch (schemaIDGUID=*) name,schemaidguid -1 \"\" CN=Schema,CN=Configuration,DC=windomain,DC=local\n```\n\nRetrieve Only the ms-Mcs-AdmPwd schemaIDGUID\n```\nldapsearch (name=ms-mcs-admpwd) name,schemaidguid 1 \"\" CN=Schema,CN=Configuration,DC=windomain,DC=local\n```\n\n# Development\nbofhound uses Poetry to manage dependencies. Install from source and setup for development with:\n\n```shell\ngit clone https://github.com/fortalice/bofhound\ncd bofhound\npoetry install\npoetry run bofhound --help\n```\n\n# References and Credits\n- [@_dirkjan](https://twitter.com/_dirkjan) (and other contributors) for [BloodHound.py](https://github.com/fox-it/BloodHound.py)\n- TrustedSec for [CS-Situational-Awareness-BOF](https://github.com/trustedsec/CS-Situational-Awareness-BOF)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ffortalice%2Fbofhound","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Ffortalice%2Fbofhound","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ffortalice%2Fbofhound/lists"}