SpecterOps / SpecterOps/MSSQLHound

Which Bloodhound API call should be used to update the schema and import data into Bloodhound?

Open
#15 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Go
Stars
346
Forks
21
PR merge metrics
No merged PRs in 30d

Description

Hi,

Thank you for this tool.

Which Bloodhound API call should be used to update the schema and import data into Bloodhound? Your instructions does not say. This is needed for the -B parameter.

Is the schema output, BloodHound-customnodes, from MSSQLHound.ps1 still valid so that it can be used as an alternative to above? Using this output it seems that for example :MSSQL_HasLogin is missing which makes for example the query MATCH p = (:Base)-[:MSSQL_HasLogin]->() RETURN p fail. On the other hand MATCH p = (:Base)-[:MSSQL_Login]->() RETURN p, which does exist, also fails. I have imported a regular Bloodhound dump as well as a dump from MSSQLHound. When I search a user account that I know has access to MS SQL I get three results, the regular original AD account node type, the new MSSQL_Login node type and the new MSSQL_DatabaseUser node type. Still the above queries and others fails.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reviewing the -B parameter instructions and the BloodHound import/API behavior, then compare the BloodHound-customnodes output from MSSQLHound.ps1 with the reported MSSQL relationship queries. Done means the supported schema-update and data-import call is identified, the schema format is confirmed, and the relevant query behavior is documented.

Written by the indexing model from the issue text.

Assessment

Tech stack
sql
Domain
databases, documentation
Issue type
Documentation
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.