hunt-sharepoint

Name: hunt-sharepoint
Availability: InStock
Author: entrovyx

Fingerprint Microsoft SharePoint Server versions and detect authentication bypass vulnerabilities.

3|1|Updated Jul 2, 2026

Search Tags:#vulnerability #reconnaissance #sharepoint #cve #pentest #redteam

Ready to run

npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill hunt-sharepoint-entrovyx

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: hunt-sharepoint
Source: https://github.com/EntroVyx/hermes-agent-offsec/tree/main/skills/offsec/redteam/hunt-sharepoint
Command: npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill hunt-sharepoint-entrovyx

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill addresses the difficulty of identifying and assessing high-impact vulnerabilities in legacy and modern Microsoft SharePoint Server environments, which are often overlooked by generic scanners.

Core Features & Use Cases

Version & CVE Mapping: Automatically fingerprints SharePoint versions to identify unpatched, end-of-life (EoL) vulnerabilities.
Attack Surface Enumeration: Probes for critical misconfigurations like legacy SOAP login bypasses, ToolShell precondition chains, and NTLM topology leaks.
Use Case: During an authorized red-team engagement, use this skill to quickly identify if a target SharePoint farm is running an EoL version and verify the presence of critical authentication bypass vectors without triggering noisy security alerts.

Quick Start

Use the hunt-sharepoint skill to fingerprint the target SharePoint server and identify potential authentication bypass vulnerabilities.

Frequently Asked Questions about hunt-sharepoint

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I identify unpatched CVEs on a Microsoft SharePoint Server farm?▼

To identify unpatched CVEs on a SharePoint Server farm, you can use non-destructive fingerprinting to map the server version against known end-of-life vulnerabilities and configuration-based attack surface signals.

What SharePoint authentication bypass vulnerabilities should I check during a pentest?▼

SharePoint reconnaissance probes for critical misconfigurations including legacy SOAP authentication bypasses, ToolShell precondition chains, and NTLM topology leaks to validate the server's security posture.

Can I perform red-team reconnaissance on SharePoint without triggering security alerts?▼

Yes, you can perform red-team reconnaissance on SharePoint without triggering alerts by using non-destructive fingerprinting of endpoints, headers, and configuration-based attack surface signals to validate security posture.

Does SharePoint vulnerability scanning detect ToolShell exploit chains?▼

SharePoint vulnerability scanning can detect ToolShell-class exploit chains by probing for ToolShell precondition chains and validating configuration-based attack surface signals during the reconnaissance process.

How do I enumerate the attack surface of an on-premise SharePoint Server?▼

Enumerate the SharePoint Server attack surface by probing endpoints and headers to identify EoL exposure, legacy SOAP authentication bypasses, and ToolShell precondition chains via non-destructive fingerprinting.

What is the best way to fingerprint SharePoint versions for EoL exposure?▼

The best way to fingerprint SharePoint versions for EoL exposure is through non-destructive endpoint and header probing, which automatically maps the identified server versions against known unpatched vulnerabilities.