hunt-sharepoint

Enumerate anonymous endpoints, version disclosures, and misconfigurations in on-premises SharePoint deployments.

3.3k|507|Updated May 5, 2026

Search Tags:#vulnerability #sharepoint #pentest #toolshell #bugbounty #authentication.asmx #picker.aspx

Ready to run

npx skills add https://github.com/elementalsouls/Claude-BugHunter --skill hunt-sharepoint-elementalsouls

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: hunt-sharepoint
Source: https://github.com/elementalsouls/Claude-BugHunter/tree/main/skills/hunt-sharepoint
Command: npx skills add https://github.com/elementalsouls/Claude-BugHunter --skill hunt-sharepoint-elementalsouls

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Shares actionable reconnaissance for on-prem SharePoint deployments by identifying anonymous endpoints, version disclosures, and misconfigurations that enable testing and hardening.

Core Features & Use Cases

Enumerates anonymous endpoints and version info across SP2013/2016/2019/SE deployments.
Validates ToolShell preconditions and SafeControl enumeration for vulnerability chains (e.g., CVE-2025-53770) in authorized red-team engagements.
Discovers custom-branding modules and NTLM topology data to map attack surfaces in enterprise AD forests.

Quick Start

Run a reconnaissance pass against a target SharePoint farm to enumerate anonymous endpoints, version information, and misconfigurations.

Frequently Asked Questions about hunt-sharepoint

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I enumerate anonymous endpoints on an on-prem SharePoint farm?▼

To enumerate anonymous SharePoint endpoints, target paths like /_layouts/15/, /_vti_bin/, /_api/, and /_catalogs/ to discover misconfigurations and version disclosures across SP2013/2016/2019 and Subscription Edition deployments.

What SharePoint paths should I test for ToolShell preconditions and CVE-2025-53770?▼

Test SharePoint paths under /_layouts/15/ and /_vti_bin/ to validate ToolShell preconditions and SafeControl enumeration for vulnerability chains like CVE-2025-53770 in authorized red-team engagements.

Does this reconnaissance approach work with SharePoint Subscription Edition?▼

Yes, this reconnaissance works with SharePoint Subscription Edition. It applies across SP2013, SP2016, SP2019, and Subscription Edition deployments to identify anonymous endpoints and custom-branding modules.

How do I discover NTLM topology data and custom-branding modules in SharePoint?▼

Discover NTLM topology data and custom-branding modules by enumerating anonymous endpoints and version disclosures across on-premises SharePoint farms to map attack surfaces in enterprise AD forests.

What is the best way to find SharePoint version disclosures during a pentest?▼

The best way to find SharePoint version disclosures is running a reconnaissance pass against the target farm to enumerate anonymous endpoints and version info across SP2013/2016/2019/SE deployments.