bloodhound-ce-python

root@kali:~# bloodhound-ce-python -h
usage: bloodhound-ce-python [-h] [-c COLLECTIONMETHOD] [-d DOMAIN] [-v]
                            [-u USERNAME] [-p PASSWORD] [-k] [--hashes HASHES]
                            [-no-pass] [-aesKey hex key]
                            [--auth-method {auto,ntlm,kerberos}]
                            [-ns NAMESERVER] [--dns-tcp]
                            [--dns-timeout DNS_TIMEOUT] [-dc HOST] [-gc HOST]
                            [-w WORKERS] [--exclude-dcs] [--disable-pooling]
                            [--disable-autogc] [--zip]
                            [--computerfile COMPUTERFILE]
                            [--cachefile CACHEFILE] [--ldap-channel-binding]
                            [--use-ldaps] [-op PREFIX_NAME]

Python based ingestor for BloodHound Community Edition
For help or reporting issues, visit https://github.com/dirkjanm/BloodHound.py

options:
  -h, --help            show this help message and exit
  -c, --collectionmethod COLLECTIONMETHOD
                        Which information to collect. Supported: Group,
                        LocalAdmin, Session, Trusts, Default (all previous),
                        DCOnly (no computer connections), DCOM, RDP,PSRemote,
                        LoggedOn, Container, ObjectProps, ACL, All (all except
                        LoggedOn). You can specify more than one by separating
                        them with a comma. (default: Default)
  -d, --domain DOMAIN   Domain to query.
  -v                    Enable verbose output

authentication options:
  Specify one or more authentication options. 
  By default Kerberos authentication is used and NTLM is used as fallback. 
  Kerberos tickets are automatically requested if a password or hashes are specified.

  -u, --username USERNAME
                        Username. Format: username[@domain]; If the domain is
                        unspecified, the current domain is used.
  -p, --password PASSWORD
                        Password
  -k, --kerberos        Use kerberos ccache file
  --hashes HASHES       LM:NLTM hashes
  -no-pass              don't ask for password (useful for -k)
  -aesKey hex key       AES key to use for Kerberos Authentication (128 or 256
                        bits)
  --auth-method {auto,ntlm,kerberos}
                        Authentication methods. Force Kerberos or NTLM only or
                        use auto for Kerberos with NTLM fallback

collection options:
  -ns, --nameserver NAMESERVER
                        Alternative name server to use for queries
  --dns-tcp             Use TCP instead of UDP for DNS queries
  --dns-timeout DNS_TIMEOUT
                        DNS query timeout in seconds (default: 3)
  -dc, --domain-controller HOST
                        Override which DC to query (hostname)
  -gc, --global-catalog HOST
                        Override which GC to query (hostname)
  -w, --workers WORKERS
                        Number of workers for computer enumeration (default:
                        10)
  --exclude-dcs         Skip DCs during computer enumeration
  --disable-pooling     Don't use subprocesses for ACL parsing (only for
                        debugging purposes)
  --disable-autogc      Don't automatically select a Global Catalog (use only
                        if it gives errors)
  --zip                 Compress the JSON output files into a zip archive
  --computerfile COMPUTERFILE
                        File containing computer FQDNs to use as allowlist for
                        any computer based methods
  --cachefile CACHEFILE
                        Cache file (experimental)
  --ldap-channel-binding
                        Use LDAP Channel Binding (will force ldaps protocol to
                        be used)
  --use-ldaps           Use LDAP over TLS on port 636 by default
  -op, --outputprefix PREFIX_NAME
                        String to prepend to output file names