ShareHound An OpenGraph Collector for Network Shares

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://specterops.io/blog/2025/10/30/sharehound-an-opengraph-collector-for-network-shares/
• Blog Title: ShareHound: An OpenGraph Collector for Network Shares
• Suggested Section: Generic Methodologies & Resources -> Pentesting Network -> SMB/Windows File Shares (and cross-link from Windows/Active Directory/BloodHound content)

🎯 Content Summary

What it is: ShareHound is an OpenGraph collector for BloodHound CE and BloodHound Enterprise that discovers SMB network shares across an AD domain, traverses files/folders, captures permissions, and outputs a JSON graph for ingestion into BloodHound. Repos: ShareHound (collector), ShareQL (DSL), and ShareQL VSCod...

🔧 Technical Details

IO-bound share crawling at scale: Treat each SMB share as the unit of work to maximize concurrency, but enforce per-host concurrency caps, throttle requests, and reuse SMB connections to avoid overwhelming servers while reducing latency.

Policy-driven traversal with a DSL: Use a firewall-style, first-match-wins ShareQL to allow/deny exploration by host/share/path and set per-rule depth limits, enabling targeted, fast crawls (e.g., only shares with names matching “backup”, depth ≤ 2).

Graph analytics of share permissions: Model hosts, shares, and files, and derive edges representing rights (e.g., CanWriteDacl, CanWriteOwner, directory-service write rights). Query principals with write-equivalent or FULL_CONTROL to pinpoint misconfigurations usable for ransomware staging or lateral movement.

File hunting via extensions: Traverse Contains edges and...

🤖 Agent Actions

I analyzed the SpecterOps blog on ShareHound and found that HackTricks’ best place to integrate this is under network services pentesting for SMB enumeration and share crawling. I updated the SMB page to include ShareHound as a modern OpenGraph collector for domain share discovery and BloodHound ingestion, including usage, ShareQL policy-driven traversal, scaling safeguards, and BloodHound attack-surface Cypher queries.

What I changed

• File modified: src/network-services-pentesting/pentesting-smb/README.md
• Added a new subsection under “Domain Shared Folders Search”:
  • ShareHound overview: LDAP→DNS→SMB→BFS/DFS crawling, ACLs to OpenGraph JSON for BloodHound CE/E
  • Scaling at scale: per-share workers, per-host concurrency caps, connection pooling/reuse, throttling, depth limiting
  • ShareQL DSL: top-down first-match-wins, allow/deny by host/share/path + per-rule depth; links to grammar and VSCode ext; minimal example rules
  • Usage example with -ai/-au/-ap/-ns and -rf for rules files
  • OpenGraph model summary and rights edges (e.g., CanWriteDacl, CanWriteOwner, CanDsWriteProperty, CanDsWriteExtendedProperties)
  • BloodHound Cypher queries:
    • principals with write-like access to shares
    • principals with FULL_CONTROL
    • hunt sensitive files by extension (e.g., .vmdk)
  • Notes on safe operation and time-constrained depth recommendations
• Updated the “References” section at the end to include:
  • SpecterOps ShareHound blog post
  • ShareHound repo
  • ShareQL repo, grammar, and VSCode extension

Why here

• The SMB page already covers domain share enumeration and tools (Snaffler, CME spider), making it the right place for ShareHound as a share-discovery and graph output tool for BloodHound workflows. Cross-linking from BloodHound pages would be ideal, but per the constraint to not add content to multiple files, I limited changes to this single file.

No other files were modified.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://specterops.io/blog/2025/10/30/sharehound-an-opengraph-collector-for-network-shares/

Content Categories: Based on the analysis, this content was categorized under "Generic Methodologies & Resources -> Pentesting Network -> SMB/Windows File Shares (and cross-link from Windows/Active Directory/BloodHound content)".

Repository Maintenance:

• MD Files Formatting: 906 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0