admin/RedByte1337-GraphSpy
1
0
Fork 0
mirror of https://github.com/RedByte1337/GraphSpy synced 2026-06-06 16:34:37 +00:00
Code Issues Packages Projects Releases Wiki Activity
Page: Release Notes
Pages
Access Tokens Custom API Requests Database Device Codes Entra ID Execution Files Generic Search GraphSpy Usage Home Installation MFA Methods MS Teams Outlook Graph Outlook Web Refresh Tokens Release Notes Roadmap SharePoint
Clone
18
Release Notes
RedByte edited this page 2026-05-05 00:03:45 +02:00
Table of Contents

Version 1.8.0 (04 May 2026)

  • New Entra ID Groups Module
    • List all Entra ID Groups
    • Open additional details of a group, such as its memberships, linked SharePoint sites, and Microsoft Teams channels
    • Recursive enumeration of Group and User memberships through the details modals
    • Export groups list to JSON for later re-importing
  • New Entra ID Roles Module
    • Enumerate both eligible and active role assignments for the entire directory using the undocumented Azure MS-PIM API (FOCI resource)
    • Export roles list to JSON for later re-importing
  • Use the v2 token endpoint with PRT tokens
  • Added a GraphSpy Favicon (Credits to ChatGPT)

Version 1.7.1 (28 April 2026)

  • Improved Entra ID Users module
    • Now supports exporting the table to JSON, and re-importing the JSON file into GraphSpy later to avoid needing to request the data each time.
  • Added --proxy argument
    • Use --proxy to proxy all backend HTTP(S) requests from the GraphSpy server through your web proxy (e.g. Burp Suite).
    • When --proxy is used, HTTPS certificate verification will be disabled to avoid running into certificate trust chain issues.

Version 1.7.0 (13 April 2026)

  • Huge Refactoring - Decompose cli.py into layered package structure (@n3rada - #18)
  • Improved logging based on loguru (@n3rada)
    • Additional --trace and --log-level arguments added
    • Better formatting with color coding
    • Saved to the graphspy\logs\graphspy.logs file by default
    • Use --utc to view logs in UTC time. Still defaults to local system time instead.
  • Default graphspy directory moved to align with the XDG specification (@n3rada)
    • Database and log folders moved from the ~\.gspy directory, to %appdata%\graphspy\ on Windows and $XDG_DATA_HOME/graphspy (= ~/.local/share/graphspy) on Linux
  • Replaced Flask by Waitress for production usage (@n3rada)
    • When running GraphSpy in production, it will be served by Waitress now.
    • For development with auto reloading and debugging, you can run it with Flask using --dev

Version 1.6.1 (31 December 2025)

  • Refactoring - Migrate to modern PyPA packaging with PEP 621 (@n3rada - #15)

Version 1.6.0 (23 December 2025)

  • Added support for version 2 of the Microsoft OAuth2 token endpoint
  • Device Certificates
    • Create new Entra ID Joined or Registered device objects using access tokens directly from within GraphSpy
    • Import Device Certificates/Keys from a compromised device, or created using a different tool
    • Use the device certificate and key to generate Primary Refresh Tokens for a user
  • Primary Refresh Token (PRT) support
    • Generate PRTs from within GraphSpy
    • Import PRTs from other tools or from compromised devices
    • Generate access tokens with PRTs
    • Generate PRT Cookies that can be imported into your browser to gain full access to any web application integrated with SSO.
  • Windows Hello for Business (whfb)
    • Register WinHello keys using a user's access token linked to a joined/registered device
    • Import WinHello keys in GraphSpy from a compromised device, or from a different tool
    • Use WinHello keys to generate new Primary Refresh Tokens for the user, without needing any additional credentials or tokens (-> Very strong persistence)
  • Added support for automatic actions that will be performed instantly after a successful device code authentication
    • Currently supports two auto-actions:
      1. Registering/Joining a device + Obtaining a PRT
      2. Everything in the previous action + Enrolling WinHello4Business for the new device to obtain WinHello keys
  • Added device code login URL hints on the Device Code page

Version 1.5.1 (10 May 2025)

  • Fixed FIDO2 key registration in the MFA module (@headszot - #7)

Version 1.5.0 (29 April 2025)

  • Released Outlook Graph Module:
    • List and read emails directly with a Microsoft Graph access token
    • Send new emails or reply to existing emails with a fully featured HTML email editor
    • List and read emails of shared mailboxes that are accessible to the user (requires the Mail.Read.Shared scope, which can be obtained with an Outlook Mobile access token)
    • Mark emails as (un)read or delete emails from the user's mailbox
    • Use custom search queries to identify sensitive information in emails
    • Download email attachments
  • Added a support button so you can support GraphSpy's development

Version 1.4.3 (15 April 2025)

  • Fixed the MFA module after Microsoft deprecated the account.activedirectory.windowsazure.com endpoint. The MFA module now uses the mysignins.microsoft.com endpoints.

Version 1.4.2 (16 January 2025)

  • Fixed saving of refresh tokens during device code authentication (@fxai - #6)

Version 1.4.1 (16 January 2025)

  • Entra ID Module:
    • List all users in Entra ID using Microsoft Graph access tokens
    • Select which properties are requested for additional customization or OPSEC considerations
    • Fully customize which properties are shown in the result table, and export the table to CSV or Excel
    • Fetch additional information for a specific user to quickly highlight all useful information, such as its group memberships, role assignments, devices, app roles, and API permissions
  • All JSON text now uses color-coded syntax highlighting across all modules
  • All JSON can be easily copied using a copy button in the top right corner
  • UI improvements to more clearly show a loading animation in several modules for requests that may take a longer time to load.

Version 1.3.0 (28 July 2024)

  • MFA Methods module:
    • List available and registered authentication options
    • Delete registered MFA methods
    • Create new MFA methods:
      • Microsoft Authenticator App
      • Custom OTP App
      • Use GraphSpy as OTP App
      • Security Keys (WebAuthn / FIDO2)
      • Mobile/Office/Alternative Phones (SMS or call)
      • Alternative email address
  • Request device codes with ngcmfa claim

Version 1.2.3 (08 July 2024)

  • Added support for the Azure AD v2.0 token endpoint, allowing to obtain access tokens based on scope instead of resource.
    • Note: the v1 token endpoint based on resource is still available (and used by default), although some specific use cases will benefit from having the option to obtain access tokens through the v2.0 endpoint (For example; obtaining access tokens for the MicrosoftAppAccessPanel resource to be able to add any type of MFA method to backdoor the account. Stay tuned!)
  • Small fix for an issue that prevented all conversations to load in the MS Teams module when the resolve conversation names feature was used, but the conversation was not a proper MS Teams Chat or Channel.

Version 1.2.2 (15 June 2024)

  • Added file upload capabilities to OneDrive & SharePoint (@pwnf - #2)
  • Delete files and folders on OneDrive & SharePoint

Version 1.2.1 (2 June 2024)

  • Improved MS Teams Module
    • List all internal users in the organization
    • Search for external users
    • Create new conversations (direct messages or group chats) with internal and external users
    • Insert fake/forged message quotes in chat messages
  • Custom requests now also show the HTTP Response headers
  • Improved all table layouts by using the correct DataTables dependencies for Bootstrap 5

Version 1.2.0 (6 May 2024)

  • Microsoft Teams Module
    • View conversations and chat messages
    • Send chat messages in existing conversations using the rich text editor
    • List members in a channel or teams space
    • Display images and download anonymous files

Version 1.1.4 (10 April 2024)

  • Added some color (@HuskyHacks - #1)
    • Device Code Table colors based on status
    • Access Token Table colors based on expiry
    • Added support for colored toast messages/notification

Version 1.1.3 (7 April 2024)

  • Custom User Agent
    • A custom user agent can now be defined on the Settings page
    • This user agent will be used in every request initiated by the GraphSpy server
    • By default, one of the latest user agents (at the time of this update) from Google Chrome on Windows will be used.
  • Access & Refresh Token modals
    • It is now even easier to switch between different access and refresh tokens from any page.
    • A "Select" button is present in every Access/Refresh Token ID field which will open an overview where every token is displayed and can be selected.

Version 1.1.0 - 1.1.2 (17 March 2024)

  • Custom API Requests
    • Perform custom API requests to any API endpoint using access tokens from the GraphSpy database for authentication
  • Custom API Request Variables
    • Create custom variables that will be replaced in the URI, Headers, and Body of custom API requests.
  • Custom API Request Templates
    • Store API Request Templates into the database for easy reuse

Navigation