omar-tamerr/horuseyeAI-Powered Active Directory Attack Platform
██╗ ██╗ ██████╗ ██████╗ ██╗ ██╗███████╗
██║ ██║██╔═══██╗██╔══██╗██║ ██║██╔════╝
███████║██║ ██║██████╔╝██║ ██║███████╗
██╔══██║██║ ██║██╔══██╗██║ ██║╚════██║
██║ ██║╚██████╔╝██║ ██║╚██████╔╝███████║
╚═╝ ╚═╝ ╚═════╝ ╚═╝ ╚═╝ ╚═════╝ ╚══════╝
███████╗██╗ ██╗███████╗
██╔════╝╚██╗ ██╔╝██╔════╝
█████╗ ╚████╔╝ █████╗ v2.3
██╔══╝ ╚██╔╝ ██╔══╝
███████╗ ██║ ███████╗
╚══════╝ ╚═╝ ╚══════╝
AI-Assisted Active Directory Attack-Path Analysis Platform
Turn raw BloodHound, Certipy, ldapdomaindump and NetExec output into a ranked, exploitability-scored list of attack paths to Domain Admin — with the exact command to validate each one.
🌐 omar-tamerr.github.io/HorusEye · Live explorer demo
Made with care by Omar Tamer — Egypt
Active Directory is the backbone of nearly every enterprise Windows environment, and the most common path to full domain compromise in penetration tests and CTF challenges like HackTheBox Pro Labs (RastaLabs, Offshore, Cybernetics, Dante), OSCP, LPT Master, and CPENT. The problem is that the toolchain is fragmented: BloodHound shows you attack paths and gives you generic commands, but when you're staring at a real engagement with 400 users, 12 service accounts, and nested group memberships, those generic commands leave you piecing things together manually. Impacket gives you execution but no analysis. Certipy gives you ADCS findings but no context on which template is actually worth pursuing first. HorusEye connects all of these. It ingests output from BloodHound, Certipy, ldapdomaindump, and CrackMapExec, scores every attack path by exploitability against your specific environment, and gives you exact commands tailored to the accounts and configurations it actually found, not a textbook example.
It ingests output from BloodHound, Certipy, ldapdomaindump, CrackMapExec and NetExec, detects 13 classes of attack path — Kerberoasting, AS-REP roasting, DCSync, ACL abuse, GPO abuse, unconstrained and constrained delegation, ADCS ESC1–ESC8, domain trusts, privileged sessions, weak password policy and stale admin accounts — scores each by exploitability against your specific environment, and tells you exactly what to run and in what order. A Tier-0 privilege model promotes any path that leads directly to Domain Admin to CRITICAL, so the ranking reflects real impact rather than a flat severity label. The optional Claude AI layer adds a plain-English narrative to each finding so you understand not just what is vulnerable but why it matters and how to chain it.
For CTF players specifically: HorusEye automates the reconnaissance-to-privilege-escalation pipeline that normally takes hours of manual work. You run SharpHound, feed the output to HorusEye, and within seconds you have a ranked list of attack paths from your current user to Domain Admin, with ready-to-paste commands for each step.
--explorer). One self-contained HTML file — a dashboard, a clickable attack-path graph (nodes/edges → evidence, choke points highlighted red), and a filterable findings explorer. No server, no external requests; open it anywhere, hand it to a client.rule_id, a confidence level with a stated reason, and structured evidence — the actual ACEs/objects behind it — so it can be reproduced from source data. Aggregated findings keep every affected object; nothing is lost to brevity.corp_domains.json), and a parse report with compatibility warnings distinguishes a clean domain from a thin import.--target paths to any critical asset (not just Tier-0); edges are labelled observed vs inferred; paths rank with a stated rationale; and remediation impact names the choke points — the single fixes that break the path.SOURCE_DATE_EPOCH), and a documented exit-code taxonomy (0/1/2/3) lets CI tell "clean" from "findings" from "incomplete".--ai-redact masks emails, IPs, domain and account names before any request; AI output is validated and can never overwrite a verified field.SECURITY.md documents intended use, data egress, and reporting.--graph). HorusEye now builds a directed control graph from group membership, abusable ACLs, local-admin rights, sessions, DCSync and delegation, and finds the shortest path from a foothold to Domain Admin — printing the ordered steps and the command for each. BloodHound shows the graph; HorusEye tells you the order to walk it. Set the foothold with --owned USER@DOMAIN (default: any domain user).--markdown) with Mermaid attack-path diagrams, and a versioned JSON schema.--diff OLD.json shows New / Fixed / Unchanged against a previous run; --fail-on LEVEL exits non-zero for CI gating.claude-opus-5-5), per-finding narratives, surfaced errors, and --ai-redact to mask client names before anything leaves the machine.UnicodeEncodeError crash; UTF-8 everywhere.horuseye command (pip install -e .); --check-deps preflight.--da-checklist and --team-connect; pytest suite + CI.See the full changelog and the Roadmap.