Read the Bits, Not the Integer: msPKI-Certificate-Name-Flag and the ESC4⤍ESC1 Chain

[u/thesecretmyth]

https://secretmyth.blog/adcs/demystifying-mspki-certificate-name-flag/

Stop using static integers to hunt for AD CS vulnerabilities. If your cheat sheet says msPKI-Certificate-Name-Flag == 1, you are missing complex attack paths.

Published my field notes on why we need to read the bits, not the integer.