# b-3llum/kerb-map architecture

> Architecture diagram of the GitHub repository b-3llum/kerb-map, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-28). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/b-3llum/kerb-map
- Repository: https://github.com/b-3llum/kerb-map

## Overview

kerb-map is an authenticated Active Directory Kerberos attack-surface mapper. The operator starts a scan through the CLI, which establishes LDAP access and runs enumeration, posture audits, and vulnerability checks; findings are consolidated into prioritized targets and exported as reports or graph data. The README also documents no-credential scans, optional aggressive RPC probes, scan caching, diffing, and resume support. Some subsystem links reflect documented capabilities because their implementation was not sampled.

Main entry points: [`kerb_map/cli.py`](https://github.com/b-3llum/kerb-map/blob/main/kerb_map/cli.py) (CLI workflow), [`kerb_map/auth/ldap_client.py`](https://github.com/b-3llum/kerb-map/blob/main/kerb_map/auth/ldap_client.py) (LDAP client), [`kerb_map/modules/cves`](https://github.com/b-3llum/kerb-map/tree/main/kerb_map/modules/cves) (CVE probes), [`kerb_map/modules`](https://github.com/b-3llum/kerb-map/tree/main/kerb_map/modules) (Legacy audits)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_scan["Scan orchestration"]
  node_cli["CLI workflow<br/>[cli.py]"]
  node_ldap["LDAP client<br/>[ldap_client.py]"]
end

subgraph group_checks["Attack surface checks"]
  node_legacy["Legacy audits"]
  node_v2["Plugin audits"]
  node_hygiene["Hygiene audit<br/>[hygiene_auditor.py]"]
  node_adcs["AD CS checks<br/>[adcs_extended.py]"]
  node_cves["CVE probes"]
  node_no_creds["No-credential scans"]
end

subgraph group_analysis["Finding analysis"]
  node_findings["Scan findings"]
  node_scorer["Priority scoring<br/>[scorer.py]"]
end

subgraph group_state["Scan state"]
  node_cache[("SQLite scan cache<br/>[cache.py]")]
  node_resume["Resume state<br/>[resume.py]"]
  node_diff["Scan comparison<br/>[diff.py]"]
end

subgraph group_outputs["Results and exports"]
  node_exporters["Report exporters<br/>[exporter.py]"]
  node_bloodhound["BloodHound CE<br/>[bloodhound_ce.py]"]
end

node_operator(("Operator"))
node_directory[("Active Directory")]
node_rpc["DC RPC services"]
node_reports["Reports and files"]

node_operator -->|"configures scan"| node_cli
node_cli -->|"authenticates"| node_ldap
node_ldap -->|"queries LDAP"| node_directory
node_cli -->|"runs checks"| node_legacy
node_cli -->|"dispatches plugins"| node_v2
node_cli -->|"runs audit"| node_hygiene
node_cli -->|"runs checks"| node_adcs
node_cli -->|"runs probes"| node_cves
node_cli -->|"runs scans"| node_no_creds
node_legacy -->|"queries directory"| node_ldap
node_v2 -->|"queries directory"| node_ldap
node_hygiene -->|"queries directory"| node_ldap
node_adcs -->|"queries directory"| node_ldap
node_cves -->|"queries directory"| node_ldap
node_cves -.->|"probes when enabled"| node_rpc
node_no_creds -->|"enumerates domain"| node_directory
node_cli -->|"prioritizes findings"| node_scorer
node_scorer -->|"returns priorities"| node_findings
node_cli -->|"stores scan"| node_cache
node_cli -->|"loads progress"| node_resume
node_cli -->|"compares scans"| node_diff
node_cache -->|"supplies cached scans"| node_diff
node_cli -->|"exports results"| node_exporters
node_cli -->|"exports graph data"| node_bloodhound
node_exporters -->|"writes reports"| node_reports
node_bloodhound -->|"writes archive"| node_reports

click node_cli "https://github.com/b-3llum/kerb-map/blob/main/kerb_map/cli.py"
click node_ldap "https://github.com/b-3llum/kerb-map/blob/main/kerb_map/auth/ldap_client.py"
click node_legacy "https://github.com/b-3llum/kerb-map/tree/main/kerb_map/modules"
click node_v2 "https://github.com/b-3llum/kerb-map/tree/main/kerb_map/modules"
click node_hygiene "https://github.com/b-3llum/kerb-map/blob/main/kerb_map/modules/hygiene_auditor.py"
click node_adcs "https://github.com/b-3llum/kerb-map/blob/main/kerb_map/modules/adcs_extended.py"
click node_cves "https://github.com/b-3llum/kerb-map/tree/main/kerb_map/modules/cves"
click node_no_creds "https://github.com/b-3llum/kerb-map/tree/main/kerb_map/modules"
click node_scorer "https://github.com/b-3llum/kerb-map/blob/main/kerb_map/modules/scorer.py"
click node_cache "https://github.com/b-3llum/kerb-map/blob/main/kerb_map/db/cache.py"
click node_resume "https://github.com/b-3llum/kerb-map/blob/main/kerb_map/resume.py"
click node_diff "https://github.com/b-3llum/kerb-map/blob/main/kerb_map/diff.py"
click node_exporters "https://github.com/b-3llum/kerb-map/blob/main/kerb_map/output/exporter.py"
click node_bloodhound "https://github.com/b-3llum/kerb-map/blob/main/kerb_map/output/bloodhound_ce.py"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_cli,node_ldap toneBlue
class node_legacy,node_v2,node_hygiene,node_adcs,node_cves,node_no_creds,node_directory toneAmber
class node_findings,node_scorer toneMint
class node_cache,node_resume,node_diff toneRose
class node_exporters,node_bloodhound,node_operator,node_rpc,node_reports toneIndigo
```

## Components

### Scan orchestration

- [CLI workflow](https://github.com/b-3llum/kerb-map/blob/main/kerb_map/cli.py): `kerb_map/cli.py`
- [LDAP client](https://github.com/b-3llum/kerb-map/blob/main/kerb_map/auth/ldap_client.py): `kerb_map/auth/ldap_client.py`

### Attack surface checks

- [Legacy audits](https://github.com/b-3llum/kerb-map/tree/main/kerb_map/modules): `kerb_map/modules`
- [Plugin audits](https://github.com/b-3llum/kerb-map/tree/main/kerb_map/modules): `kerb_map/modules`
- [Hygiene audit](https://github.com/b-3llum/kerb-map/blob/main/kerb_map/modules/hygiene_auditor.py): `kerb_map/modules/hygiene_auditor.py`
- [AD CS checks](https://github.com/b-3llum/kerb-map/blob/main/kerb_map/modules/adcs_extended.py): `kerb_map/modules/adcs_extended.py`
- [CVE probes](https://github.com/b-3llum/kerb-map/tree/main/kerb_map/modules/cves): `kerb_map/modules/cves`
- [No-credential scans](https://github.com/b-3llum/kerb-map/tree/main/kerb_map/modules): `kerb_map/modules`

### Finding analysis

- **Scan findings**
- [Priority scoring](https://github.com/b-3llum/kerb-map/blob/main/kerb_map/modules/scorer.py): `kerb_map/modules/scorer.py`

### Scan state

- [SQLite scan cache](https://github.com/b-3llum/kerb-map/blob/main/kerb_map/db/cache.py): `kerb_map/db/cache.py`
- [Resume state](https://github.com/b-3llum/kerb-map/blob/main/kerb_map/resume.py): `kerb_map/resume.py`
- [Scan comparison](https://github.com/b-3llum/kerb-map/blob/main/kerb_map/diff.py): `kerb_map/diff.py`

### Results and exports

- [Report exporters](https://github.com/b-3llum/kerb-map/blob/main/kerb_map/output/exporter.py): `kerb_map/output/exporter.py`
- [BloodHound CE](https://github.com/b-3llum/kerb-map/blob/main/kerb_map/output/bloodhound_ce.py): `kerb_map/output/bloodhound_ce.py`

### Other components

- **Operator**
- **Active Directory**
- **DC RPC services**
- **Reports and files**

## Connections

- Operator → CLI workflow: configures scan
- CLI workflow → LDAP client: authenticates
- LDAP client → Active Directory: queries LDAP
- CLI workflow → Legacy audits: runs checks
- CLI workflow → Plugin audits: dispatches plugins
- CLI workflow → Hygiene audit: runs audit
- CLI workflow → AD CS checks: runs checks
- CLI workflow → CVE probes: runs probes
- CLI workflow → No-credential scans: runs scans
- Legacy audits → LDAP client: queries directory
- Plugin audits → LDAP client: queries directory
- Hygiene audit → LDAP client: queries directory
- AD CS checks → LDAP client: queries directory
- CVE probes → LDAP client: queries directory
- CVE probes → DC RPC services: probes when enabled
- No-credential scans → Active Directory: enumerates domain
- CLI workflow → Priority scoring: prioritizes findings
- Priority scoring → Scan findings: returns priorities
- CLI workflow → SQLite scan cache: stores scan
- CLI workflow → Resume state: loads progress
- CLI workflow → Scan comparison: compares scans
- SQLite scan cache → Scan comparison: supplies cached scans
- CLI workflow → Report exporters: exports results
- CLI workflow → BloodHound CE: exports graph data
- Report exporters → Reports and files: writes reports
- BloodHound CE → Reports and files: writes archive