https://cybertoolchain.io/tools/certipy-ad New releases and features in certipy-ad, tracked by The Cyber Toolchain. en Tue, 23 Jun 2026 21:25:46 GMT https://github.com/ly4k/Certipy/releases/tag/5.1.0 https://github.com/ly4k/Certipy/releases/tag/5.1.0 Tue, 23 Jun 2026 21:25:46 GMT Certipy 5.1.0 adds ESC17 detection and sharpens ESC4's default exploit template. • Adds ESC17 attack path detection to Certipy's AD CS enumeration. • Improves ESC4 exploitation with a more targeted default ESC1 template, replacing the previous generic one. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/certipy-ad https://github.com/ly4k/Certipy/releases/tag/5.1.0 https://github.com/ly4k/Certipy/releases/tag/5.1.0 Tue, 23 Jun 2026 21:25:46 GMT Certipy 5.1.0 adds ESC17 detection/exploitation and sharpens ESC4's default template targeting. • Adds ESC17 attack path: new AD CS privilege escalation technique detection and exploitation support. • Improves ESC4 exploitation with a more targeted default ESC1 template, reducing noise and collateral scope during abuse. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/certipy-ad https://github.com/ly4k/Certipy/releases/tag/5.0.4 https://github.com/ly4k/Certipy/releases/tag/5.0.4 Sat, 22 Nov 2025 16:32:55 GMT Certipy 5.0.4 adds Outflank C2 reg query support, BloodHound SID resolution, and flexible -debug flag placement. • Supports Outflank C2 reg query command for registry operations within C2 workflows. • Allows resolving and obtaining SIDs using BloodHound integration. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/certipy-ad https://github.com/ly4k/Certipy/releases/tag/5.0.2 https://github.com/ly4k/Certipy/releases/tag/5.0.2 Sat, 17 May 2025 10:28:15 GMT Certipy 5.0.2 adds shell completions and Remote Desktop Authentication OID detection. • Adds shell completions for faster, error-free command entry. • Adds detection of the Remote Desktop Authentication OID. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/certipy-ad https://github.com/ly4k/Certipy/releases/tag/4.5.0 https://github.com/ly4k/Certipy/releases/tag/4.5.0 Sun, 18 Jun 2023 12:52:04 GMT certipy-ad v4.5.0 adds `--object-sid`, LDAP shell timeout, and default domain computer SIDs. • Adds configurable timeout for the LDAP shell session • Automatically includes domain computers group SIDs in user's SID list by default Full history on Cyber Toolchain: https://cybertoolchain.io/tools/certipy-ad https://github.com/ly4k/Certipy/releases/tag/4.4.0 https://github.com/ly4k/Certipy/releases/tag/4.4.0 Thu, 23 Mar 2023 00:11:29 GMT certipy-ad 4.4.0 expands ESC2/3 detection and fixes Python 3.11 compatibility • `ESC2` and `ESC3` checks now include `or n.`Any Purpose` = True` condition for broader detection coverage • Added Python 3.11 support to resolve compatibility issues Full history on Cyber Toolchain: https://cybertoolchain.io/tools/certipy-ad https://github.com/ly4k/Certipy/releases/tag/4.2.0 https://github.com/ly4k/Certipy/releases/tag/4.2.0 Mon, 26 Dec 2022 04:39:18 GMT Certipy v4.2.0 adds ESC11 detection and allows weak TLS ciphers in LDAP connections • Adds `--allow-weak-tls` flag to allow weak TLS ciphers in LDAP connections Full history on Cyber Toolchain: https://cybertoolchain.io/tools/certipy-ad https://github.com/ly4k/Certipy/releases/tag/4.1.0 https://github.com/ly4k/Certipy/releases/tag/4.1.0 Mon, 26 Dec 2022 04:18:23 GMT certipy-ad 4.1.0 adds LM hash output to `auth` and CA support in template properties • `certipy auth` now outputs the LM hash alongside the NT hash. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/certipy-ad https://github.com/ly4k/Certipy/releases/tag/4.0.0 https://github.com/ly4k/Certipy/releases/tag/4.0.0 Thu, 04 Aug 2022 18:21:10 GMT certipy-ad v4.0.0 adds SSPI auth, Web Enrollment, new BloodHound format, and `find` output controls • Adds `--auth-type sspi` flag for integrated Windows authentication • Supports `--upn-san` and `--dns-san` flags for certificate subject alternatives • Adds Web Enrollment support via new request options (Renew, Key Archival, Key Size) • Introduces new BloodHound output format for the forked version at github.com/ly4k/BloodHound • Adds `--hide-admins` and `--hide-non-vulnerable-templates` flags to control `find` output Breaking changes: • The `-alt` flag for SANs is replaced by `--upn-san` and `--dns-san` • RPC-based certificate enrollment is replaced by Web Enrollment as the primary method • Parameters have been restructured in general, likely changing existing command signatures Full history on Cyber Toolchain: https://cybertoolchain.io/tools/certipy-ad https://github.com/ly4k/Certipy/releases/tag/2.0.5 https://github.com/ly4k/Certipy/releases/tag/2.0.5 Tue, 22 Feb 2022 15:38:03 GMT certipy-ad v2.0.5 adds MS-RRP CA config retrieval, `forge` template/CRL options, and LDAP timeout • Added `MS-RRP` (Remote Registry) support for retrieving CA configuration when `MS-CSRA` fails • Added template and CRL options to the `forge` subcommand • Added timeout configuration for LDAP connections Full history on Cyber Toolchain: https://cybertoolchain.io/tools/certipy-ad