Skip to content

Add comprehensive ShareHound OpenGraph support to BloodBash#22

Open
DotNetRussell wants to merge 1 commit into
mainfrom
feature/sharehoud-support
Open

Add comprehensive ShareHound OpenGraph support to BloodBash#22
DotNetRussell wants to merge 1 commit into
mainfrom
feature/sharehoud-support

Conversation

@DotNetRussell

Copy link
Copy Markdown
Owner

This PR extends BloodBash with full offline analysis capabilities for ShareHound-generated BloodHound OpenGraph data. It allows red teamers and defenders to analyze large network share permission datasets without waiting for slow BloodHound CE ingestion.

Changes

  • Parser & loader improvements: Enhanced load_json_dir() and build_graph() to robustly handle ShareHound OpenGraph JSON formats, including list-style exports, relationships/edges arrays, NetworkShareSMB, Folder, and File node types.
  • New analysis module: Added print_sharehound_findings() with rich detection for:
  • High-risk writable shares (CanWriteDacl, GenericAll, FullControl, CanDsWriteProperty, CanDsControlAccess, etc.)
  • Shares accessible by “Authenticated Users” or “Everyone”
  • Sensitive files on shares (VMDK, backups, databases, archives, etc.)
  • FullControl principals
  • Folder-level permissions
  • Rich output: Added “Share Permission Summary” table and improved console reporting.
  • Severity scoring: New finding categories (Share Write Access, Share Sensitive File) integrated with existing prioritization.
  • CLI: New --sharehound flag + automatic inclusion when using --all.
  • Testing: Added 4 new unit tests covering ShareHound findings, no-results case, Authenticated Users access, and Folder/permission table output. Full test suite (53 tests) passes.
  • Documentation: Minor updates to README usage and feature list.

Why this matters
ShareHound can produce multi-GB OpenGraph JSON files on large enterprise networks. BloodHound CE ingestion can take days. BloodBash now provides fast, local, RAM-efficient analysis of exactly the same data.
Usage

python3 BloodBash /path/to/sharehound/output --sharehound --all
python3 BloodBash . --all --export=html

Testing
All existing SharpHound tests continue to pass. New ShareHound-specific tests were added and verified.

@DotNetRussell DotNetRussell self-assigned this May 22, 2026
@DotNetRussell DotNetRussell added the enhancement New feature or request label May 22, 2026
@DotNetRussell DotNetRussell linked an issue May 22, 2026 that may be closed by this pull request
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

enhancement New feature or request

Projects

None yet

Development

Successfully merging this pull request may close these issues.

RFE: add support for ShareHound JSON files

1 participant