mirror of
https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git
synced 2026-06-14 06:54:57 +03:00
mukul975
27c6414ca5
Complete skill folder anatomy across all cybersecurity skills: - scripts/agent.py: 80-150 line Python agents using real libraries (impacket, boto3, azure-mgmt-*, kubernetes, pefile, yara, scapy, shodan, stix2, etc.) - references/api-reference.md: real API documentation with method signatures - LICENSE: MIT license for all skill folders
60 lines
1.5 KiB
Markdown
60 lines
1.5 KiB
Markdown
# API Reference: BloodHound AD Attack Path Analysis
|
|
|
|
## neo4j Python Driver
|
|
```python
|
|
from neo4j import GraphDatabase
|
|
driver = GraphDatabase.driver(uri, auth=(user, password))
|
|
driver.verify_connectivity()
|
|
with driver.session() as session:
|
|
results = session.run(query, parameters)
|
|
records = [dict(record) for record in results]
|
|
driver.close()
|
|
```
|
|
|
|
## Key BloodHound Cypher Queries
|
|
|
|
### Domain Admins
|
|
```cypher
|
|
MATCH (u:User)-[:MemberOf*1..]->(g:Group)
|
|
WHERE g.name STARTS WITH 'DOMAIN ADMINS'
|
|
RETURN u.name, u.enabled
|
|
```
|
|
|
|
### Shortest Path to DA
|
|
```cypher
|
|
MATCH p=shortestPath((u:User {owned:true})-[*1..]->(g:Group))
|
|
WHERE g.name STARTS WITH 'DOMAIN ADMINS'
|
|
RETURN u.name, length(p) AS hops ORDER BY hops
|
|
```
|
|
|
|
### Kerberoastable Users
|
|
```cypher
|
|
MATCH (u:User) WHERE u.hasspn=true AND u.enabled=true
|
|
RETURN u.name, u.serviceprincipalnames
|
|
```
|
|
|
|
### Unconstrained Delegation
|
|
```cypher
|
|
MATCH (c:Computer) WHERE c.unconstraineddelegation=true
|
|
RETURN c.name, c.operatingsystem
|
|
```
|
|
|
|
## BloodHound Node Types
|
|
| Node | Properties |
|
|
|------|-----------|
|
|
| User | name, enabled, hasspn, admincount, owned, dontreqpreauth |
|
|
| Computer | name, operatingsystem, unconstraineddelegation, enabled |
|
|
| Group | name, admincount, objectid |
|
|
| GPO | name, gpcpath |
|
|
| OU | name, guid |
|
|
|
|
## BloodHound Edge Types
|
|
| Edge | Meaning |
|
|
|------|---------|
|
|
| MemberOf | Group membership |
|
|
| AdminTo | Local admin rights |
|
|
| HasSession | Active session on computer |
|
|
| GenericAll | Full object control |
|
|
| WriteDacl | Can modify ACL |
|
|
| GpLink | GPO linked to OU |
|