--- title: Introducing TailscaleHound: Mapping Tailscale Attack... description: TailscaleHound is a new OpenGraph collector for BloodHound that maps Tailscale environments — users, devices, groups, tags, ACLs, grants, SSH rules, routes,... canonical: https://daily.dev/posts/introducing-tailscalehound-mapping-tailscale-attack-paths-in-bloodhound-2nd5n7xkp twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Introducing TailscaleHound: Mapping Tailscale Attack Paths in BloodHound | daily.dev og:description: TailscaleHound is a new OpenGraph collector for BloodHound that maps Tailscale environments — users, devices, groups, tags, ACLs, grants, SSH rules, routes,... og:url: https://daily.dev/posts/introducing-tailscalehound-mapping-tailscale-attack-paths-in-bloodhound-2nd5n7xkp og:image: https://api.daily.dev/og/posts/2nd5n7xkp.png og:image:alt: Introducing TailscaleHound: Mapping Tailscale Attack Paths in BloodHound og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Introducing TailscaleHound: Mapping Tailscale Attack Paths in BloodHound **[SpecterOps](https://daily.dev/sources/specterops)** · 11 min read · 0 upvotes · 0 comments ## Summary TailscaleHound is a new OpenGraph collector for BloodHound that maps Tailscale environments — users, devices, groups, tags, ACLs, grants, SSH rules, routes, app connectors, keys, invites, webhooks, and hybrid Azure identity links — into a graph for attack-path analysis. It models 39 node kinds and 64 relationship kinds under a TS namespace, and supports both remote collection via the Tailscale API (with optional tailcontrol cookie enrichment) and local collection from tailscale status --json plus an Access Policy file. The post walks through account setup, BloodHound extension installation, and several Cypher-based saved query scenarios: finding who can reach a device, which routes are exposed via subnet routers, who can use exit nodes, who can SSH and as which user, key/tag/invite context, and hybrid Azure-to-Tailscale identity paths. It closes with practical uses for red teams (finding lateral movement and persistence paths) and defenders (spotting overbroad ACLs, stale keys/tags, and risky SSH rules). The tool is open source on GitHub and will eventually be folded into the OpenHound extension ecosystem. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I collect Tailscale data into BloodHound for attack path analysis? Use TailscaleHound, an OpenGraph collector that turns Tailscale data into BloodHound-ingestible JSON. Run it remotely with a read-only OAuth token (optionally enriched with a tailcontrol cookie for extra admin data) via `python3 TailscaleHound.py --ts-client-id ... --ts-oauth-secret ... --tailcontrol ... --output ./tailscalehound-output`, or locally using `tailscale status --json` plus an optional Access Policy file when API credentials are unavailable. _Track new attack-path tooling like this as red team and defensive workflows evolve, on daily.dev._ ### What node and relationship kinds does TailscaleHound model in BloodHound? TailscaleHound currently models 39 node kinds and 64 relationship kinds under the TS namespace, covering tailnet metadata, identities (users, groups, tags), devices and routes, ACL and grant policy, posture requirements, and tailnet objects like keys, services, app connectors, webhooks, and invites. It also creates TS_AZUserSyncedToUser edges to bridge Azure AD identities to Tailscale users for hybrid attack path analysis. _Developers securing hybrid identity setups can follow tooling updates like this via daily.dev._ ### How can I find which Tailscale users can SSH into a device and as what local user? Run a Cypher query against BloodHound after ingesting TailscaleHound data: match TS_User through TS_IsMemberOf to a group, then TS_SSHRuleSource to an SSH rule, TS_SSHRuleTargetsDevice to the target device, and TS_SSHRuleAllowsUser to the allowed local SSH user (such as root or admin). This exposes paths where broad group membership grants privileged SSH access. _daily.dev helps security practitioners keep pace with new graph-based attack path techniques like this._ ## Similar posts on daily.dev - [AWSHound: An OpenSource AWS OpenGraph Collector](https://daily.dev/posts/awshound-an-opensource-aws-opengraph-collector-nvxm1hffc) · SpecterOps · 1 upvotes · 0 comments - [Tailscale is the only home lab change I made this year that I actually noticed](https://daily.dev/posts/tailscale-is-the-only-home-lab-change-i-made-this-year-that-i-actually-noticed-hkczhi2ty) · XDA Developers · 0 upvotes · 0 comments - [Cloud Discovery With AzureHound](https://daily.dev/posts/cloud-discovery-with-azurehound-qhryprbek) · Unit 42 · 0 upvotes · 0 comments - [A Practical Approach To Graphing The Planet](https://daily.dev/posts/a-practical-approach-to-graphing-the-planet-cp6seja41) · InfoSec Write-ups · 0 upvotes · 0 comments - [Integrate Huntress endpoint security with Tailscale access policies](https://daily.dev/posts/integrate-huntress-endpoint-security-with-tailscale-access-policies-l7ijsiids) · Tailscale · 0 upvotes · 0 comments --- Tags: [#authentication](https://daily.dev/tags/authentication), [#tailscale](https://daily.dev/tags/tailscale), [#red-teaming](https://daily.dev/tags/red-teaming) [View this post on daily.dev](https://daily.dev/posts/introducing-tailscalehound-mapping-tailscale-attack-paths-in-bloodhound-2nd5n7xkp) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Introducing TailscaleHound: Mapping Tailscale Attack Paths in BloodHound","url":"https://daily.dev/posts/introducing-tailscalehound-mapping-tailscale-attack-paths-in-bloodhound-2nd5n7xkp","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/introducing-tailscalehound-mapping-tailscale-attack-paths-in-bloodhound-2nd5n7xkp"},"datePublished":"2026-08-23T12:16:32.319Z","dateModified":"2026-08-23T12:18:12.695Z","description":"TailscaleHound is a new OpenGraph collector for BloodHound that maps Tailscale environments — users, devices, groups, tags, ACLs, grants, SSH rules, routes,...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/39cad06e1bdffd3dd74bf2537374709f?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/39cad06e1bdffd3dd74bf2537374709f?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"SpecterOps","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"SpecterOps","logo":"https://media.daily.dev/image/upload/s--lR36Z4gn--/f_auto,q_auto/v1787487384/logos/specterops?_a=BAMAMicg0","url":"https://daily.dev/sources/specterops"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/introducing-tailscalehound-mapping-tailscale-attack-paths-in-bloodhound-2nd5n7xkp","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"authentication,tailscale,red-teaming","timeRequired":"PT11M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"SpecterOps","item":"https://daily.dev/sources/specterops"},{"@type":"ListItem","position":3,"name":"Introducing TailscaleHound: Mapping Tailscale Attack Paths in BloodHound"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/introducing-tailscalehound-mapping-tailscale-attack-paths-in-bloodhound-2nd5n7xkp#faq","mainEntity":[{"@type":"Question","name":"How do I collect Tailscale data into BloodHound for attack path analysis?","acceptedAnswer":{"@type":"Answer","text":"Use TailscaleHound, an OpenGraph collector that turns Tailscale data into BloodHound-ingestible JSON. Run it remotely with a read-only OAuth token (optionally enriched with a tailcontrol cookie for extra admin data) via `python3 TailscaleHound.py --ts-client-id ... --ts-oauth-secret ... --tailcontrol ... --output ./tailscalehound-output`, or locally using `tailscale status --json` plus an optional Access Policy file when API credentials are unavailable. Track new attack-path tooling like this as red team and defensive workflows evolve, on daily.dev."}},{"@type":"Question","name":"What node and relationship kinds does TailscaleHound model in BloodHound?","acceptedAnswer":{"@type":"Answer","text":"TailscaleHound currently models 39 node kinds and 64 relationship kinds under the TS namespace, covering tailnet metadata, identities (users, groups, tags), devices and routes, ACL and grant policy, posture requirements, and tailnet objects like keys, services, app connectors, webhooks, and invites. It also creates TS_AZUserSyncedToUser edges to bridge Azure AD identities to Tailscale users for hybrid attack path analysis. Developers securing hybrid identity setups can follow tooling updates like this via daily.dev."}},{"@type":"Question","name":"How can I find which Tailscale users can SSH into a device and as what local user?","acceptedAnswer":{"@type":"Answer","text":"Run a Cypher query against BloodHound after ingesting TailscaleHound data: match TS_User through TS_IsMemberOf to a group, then TS_SSHRuleSource to an SSH rule, TS_SSHRuleTargetsDevice to the target device, and TS_SSHRuleAllowsUser to the allowed local SSH user (such as root or admin). This exposes paths where broad group membership grants privileged SSH access. daily.dev helps security practitioners keep pace with new graph-based attack path techniques like this."}}]} ```