SharpHound Analyze Active Directory Security with Ease

SharpHound is a powerful data collection tool designed to gather detailed information from Active Directory environments. It helps cybersecurity professionals uncover hidden relationships between users, groups, and systems that could potentially be exploited.

Download Now

What is SharpHound?

SharpHound is a tool used to collect data from Windows domain environments, specifically from Active Directory.
It gathers information about users, computers, permissions, and relationships inside a network.

Role in Cybersecurity

In cybersecurity, SharpHound is mainly used by:

  • Penetration testers
  • Security researchers
  • Red team professionals
  • Its role is to:
  • Identify security weaknesses
  • Discover privilege escalation paths
  • Help understand how an attacker could move inside a network
sharphound

How SharpHound Works

SharpHound is designed to collect information from an Active Directory environment so it can later be analyzed in BloodHound.

Data Collection Methods

SharpHound gathers data using two main techniques:

  • LDAP (Lightweight Directory Access Protocol)
  • This is used to query Active Directory and get information about users, groups, and domain structure.
  • Windows APIs
  • Logged-in users
  • Local admin access
  • Active sessions

Types of Data Collected

SharpHound collects different kinds of information, including:

  • Users: Details about domain users (accounts, permissions, roles)
  • Groups: Information about group memberships (who belongs to which group)
  • Computers: Data about machines connected to the domain
  • Sessions: Shows which users are currently logged into which computers
  • ACLs: Permissions that define who can control or access specific resources

Data Processing Workflow

The working process of SharpHound is simple:

  • Scan the network: It queries Active Directory using LDAP and Windows APIs.
  • Collect relationships: It gathers how users, groups, and computers are connected.
  • Convert data into JSON: All collected data is saved in JSON files.
  • Export as ZIP file: Files are compressed for easy transfer.
  • Import into BloodHound: The data is loaded into BloodHound to visualize attack paths and security risks.

Key Features of SharpHound

Multi Collection

SharpHound provides flexible collection options, allowing users to gather specific Active Directory data like sessions, permissions, trusts, or everything together.

Fast Scanning

SharpHound is optimized for speed, quickly collecting large amounts of domain data using efficient queries without significantly impacting system performance or network resources.

Evasion Options

SharpHound includes stealth techniques to reduce detection, such as limiting requests, avoiding noisy scans, and blending activity with normal network behavior patterns.

Lightweight

SharpHound is a small, portable executable file that requires no installation, making it easy to deploy and run on target systems quickly.

JSON/ZIP Output Support

SharpHound saves collected data in JSON format, often compressed into ZIP files, making it easy to transfer and import into analysis tools.

System Requirements

System Requirements

Before installing SharpHound, make sure your system meets these basic requirements:

  • A Windows operating system (Windows 10/11 or Windows Server)
  • Access to a domain-joined machine
  • Installed .NET Framework (required to run the tool)
  • Basic knowledge of Active Directory

Installation Setup

Download Options

You can download SharpHound from:

  • The official GitHub repository of BloodHound
  • The official sharphound.org
  • Precompiled executable files (EXE)
  • Or source code (if you want to compile it yourself)

Running SharpHound

After downloading:

  • Place SharpHound.exe on a domain-joined system
  • Open Command Prompt (CMD) or PowerShell
  • Run a basic command like: 
				
					SharpHound.exe -c All
  • This command collects all available Active Directory data.
  • Wait for the scan to complete
  • A ZIP file containing collected data will be generated
Scroll to Top