bloodyad

Active Directory privilege escalation framework

Matches ATT&CK tactic: Privilege Escalation ↗

Platforms: Linux · Last verified September 6, 2026

bloodyAD can perform specific LDAP calls to a domain controller in order to perform AD privesc. It supports authentication using cleartext passwords, pass-the-hash, pass-the-ticket or certificates and binds to LDAP services of a domain controller to perform AD privesc.

Only use this tool against systems you own or are explicitly authorized to test — see the disclaimer.

Getting started

See the official Kali tool page and upstream homepage linked above for installation and usage details.

Commonly preinstalled on

Kali Linux

Debian-based distribution built for penetration testing and security auditing