hunt-sharepoint

Vulnerability hunting in SharePoint involves enumerating anonymous endpoints for version disclosure, bypassing authentication mechanisms, and extracting Active Directory topology via NTLM. It also includes enumerating SafeControl configurations to identify potential security risks within the server farm.

NTLM topology disclosure triggers SharePoint NTLM negotiation to expose internal Active Directory structure. This mechanism reveals domain controller names and network topology details without valid credentials, helping penetration testers map internal architecture during security assessments.

Running SharePoint security scripts requires curl, jq, and Python for command-line operations. These dependencies facilitate HTTP endpoint enumeration, JSON response parsing, and automation of vulnerability hunting tasks across the target server farm.

You can check for SharePoint authentication bypass vulnerabilities by enumerating anonymous endpoints and testing authentication mechanisms. This identifies misconfigurations that allow unauthorized access, demonstrating bypass techniques against the target server farm security controls.

SafeControl enumeration identifies available SafeControl configurations within SharePoint to locate potential vulnerabilities. It examines web.config settings for allowed controls, searching for unpatched exploits or insecure implementations that could be leveraged during penetration testing.