Skip to content

Updating feature list #11

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
DotNetRussell merged 1 commit into from
Feb 11, 2026
Merged

Updating feature list #11

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
27 changes: 17 additions & 10 deletions BloodBash
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -81,16 +81,23 @@ def print_intro_banner(mode_str):

Parses SharpHound JSON files → finds AD attack paths & misconfigurations
What it shows:
• High-value targets (admins, krbtgt, CAs, templates, NTAuth...)
• AD CS misconfigs (ESC1–ESC8)
• Dangerous ACLs & permissions (direct & indirect via groups)
• DCSync / replication rights
• RBCD opportunities
• SID history abuse
• Kerberoastable & AS-REP roastable accounts
• Weak GPO rights
• Shortest paths to high-value targets (direct & indirect)
• Local admin / session summary (when data exists)
- High-value targets identification
- ADCS vulnerabilities (ESC1–ESC8)
- Dangerous permissions (GenericAll, Owns, etc.)
- DCSync / replication rights
- RBCD (Resource-Based Constrained Delegation)
- Kerberoastable accounts
- AS-REP roastable accounts
- SID history abuse
- Unconstrained delegation
- Password in description detection
- Sessions and local admin summaries
- GPO abuse
- Shortest paths to high-value targets
- Users with 'Password Never Expires'
- Export to Markdown
- Export to HTML (with XSS protection)

Abuse suggestions: Shown once per vulnerable category (when found)
Common tools: Certipy, Impacket, Rubeus, Mimikatz, SharpGPOAbuse, etc.
Mode: [cyan]{mode_str}[/cyan]
Expand Down
29 changes: 19 additions & 10 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,6 +50,7 @@ python3 BloodBash.py . --all --export=yaml
# Fast mode (skip pathfinding)
python3 BloodBash.py sharpout --all --fast
```

### Available Flags
| Flag | Description |
|-----------------------------|------------------------------------------------------|
Expand Down Expand Up @@ -79,19 +80,27 @@ If no flags are specified, the script runs in a minimal mode. Use `--all` for fu
- **Rich colored output** using `rich` (tables, panels, highlighted paths)
- Progress bars `tqdm`) during loading and graph building
- Modular analysis with BloodHound-inspired queries:
What it shows:
- High-value targets identification
- ADCS vulnerabilities (ESC1–ESC8)
- Dangerous permissions (GenericAll, Owns, etc.)
- DCSync / replication rights
- RBCD (Resource-Based Constrained Delegation)
- Kerberoastable accounts
- AS-REP roastable accounts
- SID history abuse
- Unconstrained delegation
- Password in description detection
- Sessions and local admin summaries
- GPO abuse
- Shortest paths to high-value targets
- Users with 'Password Never Expires'
- Users with 'Password Not Required'
- Export to Markdown
- Export to HTML (with XSS protection)
- Shortest paths to high-value targets
- Dangerous permissions (GenericAll, Owns, ManageCA, Enroll, etc.)
- **ADCS ESC1–ESC8 vulnerability detection** (enhanced checks for misconfigurations)
- **GPO abuse risks** (dangerous rights on GPOs)
- **DCSync / replication rights** on domain objects
- **Resource-Based Constrained Delegation (RBCD)**
- Kerberoastable accounts
- AS-REP roastable accounts (DONT_REQ_PREAUTH)
- Session / LocalAdmin summary
- **Users with 'Password Never Expires' set** (identifies accounts with persistent passwords)
- **Users with 'Password Not Required' set** (high-risk accounts without password barriers)
- **Verbose mode** — object type counts, user list (top 30 + summary)
- **Export** results to Markdown, JSON, or YAML
- **Fast mode** `--fast`) — skips heavy pathfinding on large datasets
- Simple custom query support `--query`)

Expand Down