Search/ GitHub

For penetration testers and red teams

You found the path. Make sure it gets closed.

Your report shows how you reached Domain Admin. Pathwarden turns the same collection into every other path you didn't have time to write up, the fewest changes that close them all, and a way to prove the fixes worked when you come back.

The engagement workflow The knowledge base

Illustration: the attacker's view. A foothold lights up, and crosshairs walk the path hop by hop to Tier Zero, shown as the Pathwarden crown, which turns red: compromised. After the fix, the same path is replayed and stops at the cut: validated.

Authorized testing only. Collect and analyze only environments you have written permission to assess. Collector output is a map of the domain for an attacker: store it like credentials, encrypt it at rest and delete it when the engagement ends. This site describes attacks at the level of the public research it cites, to help defenders fix them; it doesn't give exploitation steps.

Why it helps

A typical engagement ends with one or two narrated paths to Domain Admin and a long appendix of BloodHound screenshots. The client's admins fix the steps you described, and any parallel paths through other groups, sessions and templates can stay open for the next attacker.

Pathwarden reads the SharpHound or RustHound-CE data you already have and reports every path to Tier Zero, rated by how many accounts can use it, with a remediation path that cuts all of them, and a fix guide per finding written for the people who'll do the work.

What you hand over

  • A self-contained HTML report your client can open anywhere: no BloodHound install, no database.
  • The remediation path: the fewest changes that close every path, in the order that helps most.
  • A guide per rule with console steps, PowerShell, verification and rollback.
  • A baseline to retest against when you come back.

The engagement workflow

Collect, analyze, report, validate

  1. 1. Use the data you already collected

    Pathwarden reads SharpHound (CE) and RustHound-CE output, data format v5 and v6, as zips, JSON files or folders. Load several domains together and the forest is analyzed as one graph. No upload, no server: it runs on your own computer.

    Shell
    pathwarden summary  -i ./engagement/           # what was ingested: domains, trusts, counts
pathwarden posture  -i ./engagement/           # exposure, Tier Zero protected, completeness
pathwarden report   -i ./engagement/ -o client-report.html

  2. 2. Understand the paths

    Every finding has its example path drawn out. From the command line, ask for the shortest path from an account you compromised during the test, or the relationships most paths go through. The app's Explore page expands any object's relationships and lists everything that can reach it, unprivileged users first.

    Shell
    pathwarden path         -i ./engagement/ --from jdoe
pathwarden exposure     -i ./engagement/ --samples 10
pathwarden choke-points -i ./engagement/ --top 10

    What the paths meanExploring a run

  3. 3. Recommend the fewest fixes

    pathwarden plan computes a minimum cut between every exposed account and Tier Zero. Instead of "remove these 40 ACEs", your recommendation becomes "these six changes close every path we found, and these are the findings each one closes".

    The remediation path

  4. 4. Validate the fixes

    When the client says it's done, collect again and retest against your original collection. Each finding comes back Fixed, Still open with what changed, or Can't tell when the new collection doesn't cover it. New paths that appeared since are listed too. A signed evidence pack documents the result.

    Shell
    pathwarden retest -i ./retest-collection/ --baseline ./engagement/

    Retest verdictsEvidence packs

Know the limits

What Pathwarden covers, and what it doesn't

It follows the relationships BloodHound defines for Active Directory, AD CS ESC1 to ESC11 and ESC13, SYSVOL*, OpenGraph collectors and Entra ID*. ESC11, relay to the CA over RPC, needs the CA's InterfaceFlags, which the built-in collector* reads in a Full collection. Cypher is a preview: a slice of BloodHound CE's, on Explore's Query tab in the app and with pathwarden query. It doesn't cover Azure resources or ESC12 and ESC14 to ESC16, and doesn't treat a trust between forests as a step (it reports missing SID filtering instead), though it follows the rights that cross one. Keep BloodHound CE for full custom queries.

Full comparison with BloodHound

The attacks, explained for defenders

Each article covers how attackers use a weakness, citing SpecterOps research and MITRE ATT&CK, and how to fix it. Useful for the "recommendations" section of your report.

PW-001 · PW-002 · PW-004 · PW-005 · PW-006 · PW-015 · PW-019 · PW-036 · PW-030

All articles

Very new and undergoing testing. These features haven't received a lot of testing yet. Try them out and let us know what's working.

↑↓ to moveEnter to openEsc to close