Back to blog
Jul 19, 202622 min read

BloodHound-Style Path Validation with nimux

Use nimux LDAP collection and focused queries to turn graph findings into source-backed command validation for ACL, GPO, delegation, and group paths.

BloodHoundACLPath ValidationLDAP

Overview

Graph analysis is useful, but an assessment still needs proof. A path should move from graph edge to focused query, then to a scoped validation command, then to rollback. nimux can collect BloodHound-style output and also validate the underlying LDAP relationships directly.

Collect graph data

nimux ldap dc01.corp.local -d corp.local -u operator -p '<password>' \
  --bloodhound \
  --bloodhound-out bloodhound-output

Collect targeted supporting queries:

nimux ldap dc01.corp.local -d corp.local -u operator -p '<password>' --query acl --json > acl.jsonl
nimux ldap dc01.corp.local -d corp.local -u operator -p '<password>' --query constrained --json > constrained.jsonl
nimux ldap dc01.corp.local -d corp.local -u operator -p '<password>' --query gpos --json > gpos.jsonl

Validate an ACL path

nimux ldap dc01.corp.local -d corp.local -u operator -p '<password>' \
  --acl \
  --user target.user \
  --json > target-user-acl.jsonl

If the edge is approved for validation:

nimux ldap dc01.corp.local -d corp.local -u operator -p '<password>' \
  --acl --add \
  --user target.user \
  --principal test.user \
  --rights ResetPassword \
  --dry-run \
  --rollback-out acl-path-rollback.jsonl

Validate a group path

nimux ldap dc01.corp.local -d corp.local -u operator -p '<password>' \
  --nested-groups \
  --user test.user
nimux ldap dc01.corp.local -d corp.local -u operator -p '<password>' \
  --add-member \
  --group 'Scoped Admins' \
  --user test.user \
  --dry-run \
  --rollback-out group-path-rollback.jsonl

Validate a GPO path

nimux ldap dc01.corp.local -d corp.local -u operator -p '<password>' \
  --gpo --ls --name ScopedValidationGPO
nimux ldap dc01.corp.local -d corp.local -u operator -p '<password>' \
  --gpo --link ScopedValidationGPO \
  --target 'OU=ScopedWorkstations,DC=corp,DC=local' \
  --dry-run \
  --rollback-out gpo-path-rollback.jsonl

Reporting

For each graph edge, report the graph finding, the direct LDAP evidence, the nimux validation command, the result, and rollback state. That makes the path reproducible without relying on a screenshot alone.

Install nimuxView featuresOpen docs