skills.rest
EntroVyx
EntroVyxCOMMUNITY
Explore all skills by this author →
GitHub

hunt-sharepoint

Fingerprint Microsoft SharePoint Server versions and detect authentication bypass vulnerabilities.

3|1|Updated Jul 2, 2026
Search Tags:#vulnerability#reconnaissance#sharepoint#cve#pentest#redteam
One-click install
npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill hunt-sharepoint-entrovyx
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-sharepoint
Source: https://github.com/EntroVyx/hermes-agent-offsec/tree/main/skills/offsec/redteam/hunt-sharepoint
Command: npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill hunt-sharepoint-entrovyx

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill addresses the difficulty of identifying and assessing high-impact vulnerabilities in legacy and modern Microsoft SharePoint Server environments, which are often overlooked by generic scanners.

Core Features & Use Cases

  • Version & CVE Mapping: Automatically fingerprints SharePoint versions to identify unpatched, end-of-life (EoL) vulnerabilities.
  • Attack Surface Enumeration: Probes for critical misconfigurations like legacy SOAP login bypasses, ToolShell precondition chains, and NTLM topology leaks.
  • Use Case: During an authorized red-team engagement, use this skill to quickly identify if a target SharePoint farm is running an EoL version and verify the presence of critical authentication bypass vectors without triggering noisy security alerts.

Quick Start

Use the hunt-sharepoint skill to fingerprint the target SharePoint server and identify potential authentication bypass vulnerabilities.

Frequently Asked Questions about hunt-sharepoint

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I identify unpatched CVEs on a Microsoft SharePoint Server farm?▼

To identify unpatched CVEs on a SharePoint Server farm, you can use non-destructive fingerprinting to map the server version against known end-of-life vulnerabilities and configuration-based attack surface signals.

What SharePoint authentication bypass vulnerabilities should I check during a pentest?▼

SharePoint reconnaissance probes for critical misconfigurations including legacy SOAP authentication bypasses, ToolShell precondition chains, and NTLM topology leaks to validate the server's security posture.

Can I perform red-team reconnaissance on SharePoint without triggering security alerts?▼

Yes, you can perform red-team reconnaissance on SharePoint without triggering alerts by using non-destructive fingerprinting of endpoints, headers, and configuration-based attack surface signals to validate security posture.

Does SharePoint vulnerability scanning detect ToolShell exploit chains?▼

SharePoint vulnerability scanning can detect ToolShell-class exploit chains by probing for ToolShell precondition chains and validating configuration-based attack surface signals during the reconnaissance process.

How do I enumerate the attack surface of an on-premise SharePoint Server?▼

Enumerate the SharePoint Server attack surface by probing endpoints and headers to identify EoL exposure, legacy SOAP authentication bypasses, and ToolShell precondition chains via non-destructive fingerprinting.

What is the best way to fingerprint SharePoint versions for EoL exposure?▼

The best way to fingerprint SharePoint versions for EoL exposure is through non-destructive endpoint and header probing, which automatically maps the identified server versions against known unpatched vulnerabilities.

Related Skills

Explore More Software Engineering Skills→
uphiagouphiago
1.1k

hunt-sharepoint

Hunt critical vulnerabilities and misconfigurations in on-prem Microsoft SharePoint Server deployments.

Community
Advanced
pdparchitectpdparchitect
13

hunt-sharepoint

Detect SharePoint Server vulnerabilities including SOAP authentication bypasses and ToolShell chains.

Community
Advanced
bpnrockstarbpnrockstar

hunt-ntlm-info

Identify NTLM/Negotiate information disclosure from IIS, SharePoint, and Exchange servers.

Community
Advanced
RifteoRifteo
30

less-noise-attack

Execute low-noise offensive security operations with passive reconnaissance and bounded enumeration.

Official
Advanced