> ## Documentation Index
> Fetch the complete documentation index at: https://specterops-fetch-json-component.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Overview

> Learn about OktaHound, an OpenGraph extension and data collector for Okta organizations.

<img noZoom src="https://mintcdn.com/specterops-fetch-json-component/pkiaFEhjWYPnhxMb/assets/enterprise-AND-community-edition-pill-tag.svg?fit=max&auto=format&n=pkiaFEhjWYPnhxMb&q=85&s=c83d7e4a67c741a979c0e77bf15c1252" alt="Applies to BloodHound Enterprise and CE" width="482" height="45" data-path="assets/enterprise-AND-community-edition-pill-tag.svg" />

OktaHound is an OpenGraph extension and data collector for [Okta Platform](https://www.okta.com/products/workforce-identity/) (also known as Okta Workforce Identity Cloud) environments that helps security professionals visualize and analyze their Okta configurations in BloodHound.

It collects data about users, groups, applications, roles, and other entities within an Okta organization and represents them as [nodes](/opengraph/extensions/oktahound/reference/schema#nodes) and [edges](/opengraph/extensions/oktahound/reference/schema#edges) in BloodHound's graph database.

<Note>The other main product in Okta's portfolio is [Auth0](https://auth0.com/) (previously known as Customer Identity Cloud). OktaHound **does not** currently support Auth0.</Note>

## Okta Attack Paths

Okta is an interesting target for attackers because it is widely used by organizations to manage access to their cloud and on-premises applications.

Compromising an Okta organization can provide attackers with access to a wide range of resources and data. Okta organizations seem to be secure by default.
Multi-factor authentication (MFA) is enforced for all users and re-authentication is required for sensitive administrative tasks.

![Default Catch-All rule](https://support.okta.com/help/servlet/rtaImage?eid=ka0KZ000000Q2en\&feoid=00N0Z00000GpsjQ\&refid=0EMKZ000000FtDI)

Okta also uses role-based access control (RBAC) to mitigate privilege escalation paths. For example, only Super Administrators can manage groups that have administrative roles. As a result, most attack paths stem from misconfigurations, including excessive role assignments, weak authentication policies, insecure application integrations, and exposure of sensitive credentials.

You should also account for users who are non-privileged in Okta but hold administrative access in connected applications,
such as GitHub Enterprise Cloud or Amazon Web Services (AWS). Hybrid attack paths between on-premises Active Directory and Okta are also possible.

<img src="https://mintcdn.com/specterops-fetch-json-component/Aknesi2NwciziFMX/images/extensions/oktahound/reference/bloodhound-role-assignments.png?fit=max&auto=format&n=Aknesi2NwciziFMX&q=85&s=47967d468ee37e238faae625d6555190" alt="Okta role assignments displayed in BloodHound" width="1958" height="1394" data-path="images/extensions/oktahound/reference/bloodhound-role-assignments.png" />

<Note>Our research on Okta attack paths is still ongoing. Interesting mappings to MITRE ATT\&CK are [available from Elastic](https://github.com/elastic/detection-rules/tree/main/rules/integrations/okta).</Note>

## Okta Free Trial

Okta provides a [free trial](https://developer.okta.com/signup/) plan that you can use to test the majority of OktaHound features.

## References

The following blog posts provide insights into Okta attack vectors and techniques:

* [Michael Grafnetter (SpecterOps): Discovering Unexpected Okta Attack Paths with BloodHound](https://specterops.io/blog/2026/03/23/discovering-unexpected-okta-attack-paths-with-bloodhound/)
* [Adam Chester (SpecterOps): Okta for Red Teamers](https://blog.xpnsec.com/okta-for-redteamers/)
* [Adam Chester (SpecterOps): Identity Providers for RedTeamers](https://blog.xpnsec.com/identity-providers-redteamers/)
* [Eli Guy (XM Cyber): Attack Techniques in Okta - Part 1 - A (Really) Deep Dive into Okta Key Terms](https://xmcyber.com/blog/attack-techniques-in-okta/)
* [Eli Guy (XM Cyber): Attack Techniques in Okta - Part 2 - Okta RBAC Attacks](https://xmcyber.com/blog/okta-rbac-attacks/)
* [Eli Guy (XM Cyber): Attack Techniques in Okta - Part 3 - From Okta to AWS Environments](https://xmcyber.com/blog/okta-attack-techniques-part-3-from-okta-environments-to-aws/)
* [AppOmni: Okta PassBleed Risks - A Technical Overview](https://appomni.com/ao-labs/okta-passbleed-risks/)
* [Luke Jennings (PushSecurity): Abusing Okta's SWA authentication](https://pushsecurity.com/blog/okta-swa/)
* [David French (Elastic): Testing your Okta visibility and detection with Dorothy and Elastic Security](https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy)

## Research Tools

Here are some interesting GitHub repositories related to Okta security research:

* [Okta Post-Exploitation Toolkit](https://github.com/xpn/OktaPostExToolkit)
* [Okta Terrify](https://github.com/CCob/okta-terrify)
* [Dorothy](https://github.com/elastic/dorothy)
* [SaaS Attacks](https://github.com/pushsecurity/saas-attacks/)
* [Okta SCIM Attack Tool](https://github.com/authomize/okta_scim_attack_tool)

## Community

Please join us in the `#okta` channel of the [BloodHound Community Slack](https://slack.specterops.io/) workspace if you want to chat about attack paths in Okta or the usage of OktaHound. You are also welcome to open an issue or pull request on [GitHub](https://github.com/SpecterOps/OktaHound/).