TODO.md

Importers:

• Import NTLM Hashes from .ntds output txt file (generated by CrackMapExec or secretsdump.py)
• Import NTLM Hashes from NTDS.dit and SYSTEM
• Import Cracked NTLM hashes from hashcat output file
• Import BloodHound ZIP or JSON file
• BloodHound importer (import JSON to Neo4J without BloodHound UI)
• Import Domain data from BloodHound
• Import User data from BloodHound
• Import Group data from BloodHound
• Import Domain data from Powershell MSOnline module
• Import User data from Powershell MSOnline module
• Import Group data from Powershell MSOnline module
• Import NTLM Hashes from CrackMapExec output file
• Import data from ldapsearch
• Import data from Sysinternals ADExplorer
• Import Cracked NTLM hashes from John the Ripper output file

Analysers

• Analyse the quality of password (length , lower case, upper case, digit, special and latin)
• Analyse similarity of password with company name
• When added user as compromised, alert id this user may have a path to critical target

Finders

• Search for users
• Search for user password (Hash a clear-text)
• Search filter from cracked only passwords

Statistics

• Generate Top 10 cracked passwords
• Generate Top 10 cracked passwords by domain
• Generate Top 10 cracked passwords by similarity with company name

Exporters

• Export data to JSON file
• Export all cracked credentials to BloodHound Neo4j Database as 'owned object'
• Export all data to BloodHound Neo4j Database (much faster than BloodHound UI)
• Export data to Splunk
• Export data to ElasticSearch
• Export Password Spray list

Wipe

• Module to clear sensitive data (Clear text passwords and hashes) keeping statistics

Internal

• Implement test script with one sample BloodHound importer