How to Convert Custom Queries from BloodHound Legacy to BloodHound CE

BloodHound CE (Community Edition) brings numerous improvements over the legacy version, but the custom queries format has changed and you can’t just drag and drop the custom queries into BloodHound CE to upload custom queries. This is very cumbersome since a lot of great custom queries were made for BloodHound Legacy.

To make sure you can still use the awesome queries from BloodHound Legacy, I created a tool to automatically convert and upload any custom query from BloodHound Legacy to BloodHound CE.

To learn more about the tool, you can find its GitHub repository here:

• https://github.com/WafflesExploits/Bloodhound-query-legacy2ce

🎥 Quick Demo of the tool:

Step-by-Step Instructions

Here’s how you can use this tool to quickly convert and upload your favorite custom queries

• 1. Select a Custom Query Collection
• 2. Get the BloodHound’s API JWT
• 3. Running the Tool
• 4. Verifying Your Queries

1. Select a Custom Query Collection

Here are some popular query collections you can test with:

• AzureHound Custom Queries
• ZephrFish Custom Queries
• Hausec Custom Queries

2. Get the BloodHound’s API JWT

1. Open BloodHound’s API Explorer
2. Find the “Get Self API” request and click “Try It Out”
   • 
3. Execute the request
4. Copy your JWT Token from the Authorization Bearer header
   • 

3. Running the Tool

After grabbing the JWT Token, you can install the tool like so:

git clone https://github.com/WafflesExploits/Bloodhound-query-legacy2ce
cd Bloodhound-query-legacy2ce
pip install -r requirements.txt

Run the command below to convert and upload your custom queries:

python upload_bloodhound_queries.py --input-file customqueries.json --jwt-token <YOUR_JWT_TOKEN>

The tool supports additional options:

1. Convert only (no upload): –convert-only –output-file output-file-name.json
2. Specify API URL: –api-url API-URL
   • (By defaults the tool uses: http://localhost:8080/api/v2/saved-queries)

4. Verifying Your Queries

After upload, verify your queries in BloodHound CE:

1. Go to the Explore tab
2. Select the Cypher tab
3. Click the folder icon (📁)
4. Open “Custom Queries” from the dropdown
   • 

That’s it! You can now use your favorite BloodHound Legacy queries in BloodHound CE. Happy Hunting! 🎯