hunt-sharepoint

What problem does it solve?

It helps you identify internet-exposed Microsoft SharePoint Server misconfigurations and unpatched routes that enable high-impact security findings, without manually guessing endpoints and fingerprints.

Core Features & Use Cases

• Version and build fingerprinting: Detects SharePoint edition/version via anonymous pages and API responses to prioritize EoL risk and CVE relevance.
• Anonymous surface mapping: Enumerates key endpoints and response-header signals to find misconfigured authentication paths.
• High-value precondition checks: Validates risky chains (e.g., anonymous FormDigest issuance and ToolPane ToolShell preconditions) safely through guardrailed request patterns.
• Reflection and AD topology recon: Uses Picker.aspx SafeControl error differentials and NTLM Type-2 challenge decoding for targeted, defensible intelligence.
• Custom branding discovery: Finds customer-specific module directories and highlights likely maintenance/endpoint routes from static resource patterns.

Quick Start

Use this skill to enumerate a target SharePoint Server by checking version disclosures, anonymous endpoint behavior, and high-value preconditions starting from indicators like /_layouts/15/ and /_vti_bin/Authentication.asmx.