> For the complete documentation index, see [llms.txt](https://watchdogsacademy.gitbook.io/attacking-active-directory/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://watchdogsacademy.gitbook.io/attacking-active-directory/user-acl-exploits/hunting-with-bloodhound.md).
# Hunting with bloodhound
Now start neo4j and bloodhound
Upload the zips into neo4j
and now show all domains and computer
```
MATCH p = (d:Domain)-[r:Contains*1..]->(n:Computer) RETURN p
```
And show all the users
```
MATCH p = (d:Domain)-[r:Contains*1..]->(n:User) RETURN p
```
let see the overall map of domains/groups/users
```
MATCH q=(d:Domain)-[r:Contains*1..]->(n:Group)<-[s:MemberOf]-(u:User) RETURN q
```
Let see the users ACL
```
MATCH p=(u:User)-[r1]->(n) WHERE r1.isacl=true and not tolower(u.name) contains 'vagrant' RETURN p
```
* If you want to dig more I recommend the following articles with a lot of useful informations and queries :
*
*
