All topics ›
Ethical Hacking ›
Active Directory
Active Directory · Ethical Hacking What is BloodHound and how do you use it in AD pen-test?
BloodHound (Specter Ops) — Active Directory attack path visualisation tool. Workflow: (1) SharpHound (data collector) — gather AD info: users, groups, sessions, ACLs, GPOs. (2) Upload data to Neo4j-backed BloodHound GUI. (3) Query attack paths — built-in queries like 'shortest path from any user to Domain Admin'. (4) Identify chained vulnerabilities: GenericWrite → ForceChangePassword → AdminTo → DA. (5) Plan exploit — execute attack chain using PowerSploit, Mimikatz, ImpacketIn. BloodHound mastery is non-negotiable for senior AD pen-test interviews. CE version free; Enterprise version (paid) has more features.
Want the full explanation? This is the atomic answer suitable for
quick interview prep. For the structured deep-dive — including code samples,
strong-answer vs weak-answer notes, common follow-up questions, and how this fits
the larger ethical hacking topic — see the full Q&A on Networkers Home:
→ Ethical Hacking Interview Hub — Full Q&A with deep context
→ Ethical Hacking Interview Hub — Full Q&A with deep context
How Networkers Home prepares students for this kind of question
This question reflects real interview rounds at Bangalore's top product, BFSI, and GCC cybersecurity teams. Networkers Home's flagship courses include mock interview sessions drilling exactly these question patterns, with feedback from interviewers who have hired for the role.
→ View the complete ethical hacking interview prep hub
→ View the related Networkers Home course
→ Book a free career consultation
Related Active Directory questions
Active Directory
Q. Explain Kerberoasting attack with full chain.
Kerberoasting — extract service account password hashes from AD. Chain: (1) As any AD user, query domain for SPNs (Service Principal Names) — every service-using account has SPN. (2) Request Kerberos service ticket (TGS)…
Read full answer → Active Directory
Q. Explain Pass-the-Hash, Pass-the-Ticket, and Pass-the-Key.
All authentication abuse techniques in Windows AD. PtH — use NTLM hash directly (without knowing password) to authenticate to remote service. Tools: Mimikatz sekurlsa::pth, Impacket secretsdump → wmiexec. PtT — use Kerbe…
Read full answer →