NetworkHound Sniffs Out the Network Active Directory Forgot
NetworkHound maps Active Directory sites, subnets and computers, then searches for exposed web services, SMB shares and devices the directory does not know about. The result is a BloodHound-compatible view of the network behind the official network.
