Wrapper for LDAP search using impacket

Login to BloodHound API.

Close the session.

Check if IP address is valid and not multicast/reserved

Parse binary SID to string format

Return list of default ports for this protocol Returns: list: List of default port numbers

Load Kerberos ticket

Recursive function to split LDAP searches when size limit is exceeded Args: ldapConnection: LDAP connection obje

Create a Website node from HTTP validation results

Validate SMB connectivity on multiple IP:port combinations using threading

Extract domain SID from a computer object SID

Try to resolve DC IP to NetBIOS hostname for proper Kerberos SPN Tries multiple methods: 1. SMB connection (TCP 445/139) - mo

Build complete network topology

Create FileShare nodes based on SMB validation results using SMB Shares Manager

Get domain information including SID

Query AD Sites and Services for configured subnets

Query AD subnets using impacket LDAP with password authentication (Configuration container requires it)

Query AD Sites and Services for configured subnets

Save data to JSON file with domain info

Scan IP range for shadow-IT devices not in Active Directory with explicit subnet name

Test if computer is reachable via ping

Test connectivity to multiple hosts using threading

Wrapper for connection cleanup

Analyze SSL certificate and connection security

Collect IP:port targets relevant for a specific validator

Create a standard error result

Enumerate SMB shares and test accessibility

Extract public key information from certificate

Load all available validators

Log validation result - can be overridden by subclasses

Log SMB validation result

Parse certificate extensions

Process NTLM hash to correct format

Parse X.509 certificate object into standard format

Static version of DC hostname resolution for use outside class Tries multiple TCP-friendly methods (for proxychains compatibility): 1. SM

Fallback method for Kerberos - uses minimal subprocess only for computer objects

Connect to Domain Controller using LDAP

Connect to existing Domain node instead of creating a new one

Connect to Domain Controller using impacket authentication Returns: tuple: (connection, extracted_domain, extracted_username) or None

Create Computer nodes and their relationships (only for computers with IP addresses or open ports)

Create edges from computer to subnets

Create Device nodes for shadow-IT devices

Create edge from device to subnet

Create Website relationships for shadow-IT devices

Create dummy computer objects from discovered live IPs

Create FileShare node data for a computer based on SMB validation results

Create Site nodes from subnet information

Create Subnet nodes and link them to sites

Delete a specific custom node by kind name.

Close LDAP connection

Auto-discover /24 subnets from AD computer IP addresses only

Get domain users list

Get list of existing custom nodes from BloodHound (visibility/diagnostics).

Get detailed information about all protocols

Get common service name for a port

Get SSL certificate information Args: ip: Target IP address port: Target port detailed: If False,

Get typical Windows shares based on computer type

Get a validator instance for a specific protocol

Logout from BloodHound API.

Main function

Main entry point.

Match resolved IPs to AD-configured subnets - handles multiple IPs per computer

Match resolved IPs to AD-configured subnets - handles multiple IPs per computer

Parse command line arguments

Parse command line arguments.

Parse Kerberos ticket cache to extract username and domain

Parse manual network specification into standardized format Supports: - CIDR notation: 192.168.1.0/24 - Single IPs: 192.168.1.1 -

Perform HTTP/HTTPS validation on discovered open ports Args: port_scan_results: Results from port scanning max_threads: Maxim

Perform SMB validation on discovered SMB ports Args: port_scan_results: Results from port scanning max_threads: Maximum numbe

Query all computer objects from Active Directory

Delete all existing custom nodes.

Enhanced IP resolution with threading support

Enhanced IP resolution with threading support

Enhanced IP resolution for a single computer using multiple methods

Enhanced IP resolution for a single computer using multiple methods Note: This function is deprecated - use DNSResolver class instead! Ke

Perform network port scanning on all computers in parallel

Scan multiple ports on all IPs of a computer

Fast threaded port scan for multiple IPs (multiprocessing removed for stability)

Scan IP range for shadow-IT devices not in Active Directory with explicit subnet name Args: subnet_str: Subnet string representation

Setup logging configuration (console INFO/DEBUG).

Setup logging configuration.

Test if computer is reachable via ping

Test connectivity to multiple hosts using threading

Test LDAP connection

Test SMB connection

Upload the Custom Nodes/Edges model to BloodHound (pre‑ingest).

Validate HTTP/HTTPS connectivity on multiple IP:port combinations using threading

Validate a single IP:port combination Args: ip: Target IP address port: Target port **kw

Validate multiple IP:port combinations using threading/multiprocessing Args: ip_port_list: List of (ip, port) tu

Context manager entry

Context manager exit

Delegate other attributes to the impacket auth object

Initialize the authentication class Args: target: Server address (IP or hostname) domain: Domain nam