skills.rest
elementalsouls
elementalsoulsCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

hunt-sharepoint

Enumerate anonymous endpoints, version disclosures, and misconfigurations in on-premises SharePoint deployments.

3.3k|507|Updated May 5, 2026
Search Tags:#vulnerability#sharepoint#pentest#toolshell#bugbounty#authentication.asmx#picker.aspx
One-click install
npx skills add https://github.com/elementalsouls/Claude-BugHunter --skill hunt-sharepoint-elementalsouls
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-sharepoint
Source: https://github.com/elementalsouls/Claude-BugHunter/tree/main/skills/hunt-sharepoint
Command: npx skills add https://github.com/elementalsouls/Claude-BugHunter --skill hunt-sharepoint-elementalsouls

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Shares actionable reconnaissance for on-prem SharePoint deployments by identifying anonymous endpoints, version disclosures, and misconfigurations that enable testing and hardening.

Core Features & Use Cases

  • Enumerates anonymous endpoints and version info across SP2013/2016/2019/SE deployments.
  • Validates ToolShell preconditions and SafeControl enumeration for vulnerability chains (e.g., CVE-2025-53770) in authorized red-team engagements.
  • Discovers custom-branding modules and NTLM topology data to map attack surfaces in enterprise AD forests.

Quick Start

Run a reconnaissance pass against a target SharePoint farm to enumerate anonymous endpoints, version information, and misconfigurations.

Frequently Asked Questions about hunt-sharepoint

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I enumerate anonymous endpoints on an on-prem SharePoint farm?▼

To enumerate anonymous SharePoint endpoints, target paths like /_layouts/15/, /_vti_bin/, /_api/, and /_catalogs/ to discover misconfigurations and version disclosures across SP2013/2016/2019 and Subscription Edition deployments.

What SharePoint paths should I test for ToolShell preconditions and CVE-2025-53770?▼

Test SharePoint paths under /_layouts/15/ and /_vti_bin/ to validate ToolShell preconditions and SafeControl enumeration for vulnerability chains like CVE-2025-53770 in authorized red-team engagements.

Does this reconnaissance approach work with SharePoint Subscription Edition?▼

Yes, this reconnaissance works with SharePoint Subscription Edition. It applies across SP2013, SP2016, SP2019, and Subscription Edition deployments to identify anonymous endpoints and custom-branding modules.

How do I discover NTLM topology data and custom-branding modules in SharePoint?▼

Discover NTLM topology data and custom-branding modules by enumerating anonymous endpoints and version disclosures across on-premises SharePoint farms to map attack surfaces in enterprise AD forests.

What is the best way to find SharePoint version disclosures during a pentest?▼

The best way to find SharePoint version disclosures is running a reconnaissance pass against the target farm to enumerate anonymous endpoints and version info across SP2013/2016/2019/SE deployments.

Related Skills

Explore More Software Engineering Skills→
yu13130122297yu13130122297

scout

Identify uncertainties in research framing, datasets, metrics, and baselines.

Community
Intermediate
EntroVyxEntroVyx
3

recon-fire-restoration

Automate security reconnaissance of WordPress restoration sites to detect PII leaks and misconfigurations.

Community
Intermediate
cmndcntrlcybercmndcntrlcyber
3

hunt-sharepoint

Enumerate SharePoint Server endpoints and exploit authentication bypass vulnerabilities.

Community
Advanced
AeonDaveAeonDave
15

dirsearch

Scan web servers for hidden directories and files with recursive scanning.

Community
Intermediate