HoundMasker: Privacy-Preserving Attack Path Analysis | Hacker Summer 2026 Community Session 2

This presentation introduces OneMask, a Python tool designed to mask sensitive identity information in Bloodhound JSON data, enabling safe analysis of internal network Active Directory structures using Large Language Models (LLMs) without compromising privacy 11:32.

Key Takeaways:
• Active Directory is central to enterprise security, and Bloodhound is a standard tool for enumerating attack paths, but its data contains sensitive identifiers that pose privacy risks when shared 03:30.
• Uploading raw Bloodhound data to public LLMs is dangerous as models may retain sensitive infrastructure details; OneMask solves this by anonymizing the data while preserving structural relationships 10:23.
• The tool masks usernames, computer names, and descriptions using random strings but preserves Security Identifiers (SIDs) and domain trust relationships to maintain the integrity of the attack graph 14:32.
• A live demo showed OneMask processing JSON files to generate anonymized outputs, which were then queried via a Bloodhound MCP server to demonstrate privilege escalation paths without revealing real identities 18:34.
• While effective, the tool currently supports only specific Bloodhound JSON files and has limitations regarding certain attribute masking, requiring users to verify data for residual sensitive information before use 38:53.

OneMask facilitates secure collaboration and AI-assisted security analysis by removing personally identifiable information while keeping the technical context intact for pentesters and researchers.

Sources:

• 11:32 Introduction of OneMask tool for data privacy.