WEBVTT

00:00:02.490 --> 00:00:06.340
Active Directory security and BloodHound is a pretty wide topic.

00:00:06.560 --> 00:00:09.250
There's a lot of capabilities we didn't discuss today,

00:00:09.740 --> 00:00:12.130
and there's some related information that I think will be really

00:00:12.130 --> 00:00:14.950
useful to you as you go forward and use these tools.

00:00:15.940 --> 00:00:16.590
First of all,

00:00:16.590 --> 00:00:21.130
the Cypher query language from Neo4j used by BloodHound is extremely powerful,

00:00:21.130 --> 00:00:24.050
and I highly encourage you to check out how it works so

00:00:24.050 --> 00:00:25.280
you can write some custom queries.

00:00:26.500 --> 00:00:30.800
There's also a REST API for Neo4j which will let you use the data

00:00:30.970 --> 00:00:34.900
that BloodHound also uses in an automated fashion.

00:00:35.000 --> 00:00:37.950
This could be great for defenders wanting to automate this or

00:00:37.950 --> 00:00:40.270
for attackers building more efficient tools.

00:00:40.560 --> 00:00:44.760
The BloodHound‑owned script lets you work with the metadata on

00:00:44.760 --> 00:00:47.160
these different objects and optimize queries.

00:00:47.880 --> 00:00:53.010
Now I highly recommend that you check adsecurity.org if you're an attacker or

00:00:53.010 --> 00:00:56.990
a defender. You can learn a lot about protecting or attacking Active Directory

00:00:57.120 --> 00:00:59.670
and things like delegation and Kerberoasting,

00:00:59.670 --> 00:01:02.750
which obviously relates directly to BloodHound.

00:01:03.440 --> 00:01:06.660
But I would also like to point out that Responder is still a tool that

00:01:06.660 --> 00:01:10.390
works in a lot of Active Directory environments and that lets you steal so

00:01:10.390 --> 00:01:15.540
many credentials that you can then mark as owned in BloodHound to quickly

00:01:15.540 --> 00:01:20.430
get a path to where you're going. And talking about Responder, there's a

00:01:20.430 --> 00:01:24.750
great red team tools course about Responder on Pluralsight, so you should

00:01:24.750 --> 00:01:25.850
also check that out.

00:01:26.540 --> 00:01:29.300
Thanks for taking the time to follow this course about BloodHound,

00:01:29.310 --> 00:01:30.770
and I hope you really enjoy it.