skills.rest
inventashif
inventashifCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

hunt-sharepoint

Enumerate and assess on-prem Microsoft SharePoint farms for anonymous endpoints and known CVE preconditions.

Updated Sep 6, 2026
Search Tags:#penetration testing#sharepoint#enumeration#bug bounty#authentication bypass#ntlm#cve-2025-53770
One-click install
npx skills add https://github.com/inventashif/helpful-code-sidekick --skill hunt-sharepoint-inventashif
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-sharepoint
Source: https://github.com/inventashif/helpful-code-sidekick/tree/main/scripts/hackerai/skills/bughunter/hunt-sharepoint
Command: npx skills add https://github.com/inventashif/helpful-code-sidekick --skill hunt-sharepoint-inventashif

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Security testers assessing internet-facing SharePoint Server farms often miss high-impact issues like the legacy Authentication.asmx SOAP login bypass, ToolShell (CVE-2025-53770) preconditions, and NTLM topology leaks, or waste time on false positives like misreading download.aspx as SSRF. ## Core Features & Use Cases - Version Fingerprinting & CVE Mapping: Extract exact SharePoint build numbers via _vti_inf.html, _api/contextinfo, and start.aspx, then map them to unpatched CVEs, especially for end-of-life SP2013 farms. - Anonymous Endpoint Matrix: Systematically probe /_layouts/15/, /_vti_bin/, and /_api/ paths to identify anonymously reachable attack surface including FormDigest issuance and ToolPane.aspx. - Legacy SOAP Login Testing: Validate whether Authentication.asmx accepts anonymous Forms-auth login attempts without rate limiting or lockout, bypassing branded login page protections. - Use Case: During an authorized bug bounty engagement against a dealer portal, you fingerprint the farm as SP2013 build 15.0.5545.1000, confirm the ToolShell precondition chain with three curl requests, and document a Critical finding without delivering any malicious payload. ## Quick Start Fingerprint the SharePoint version of the authorized target and run the anonymous endpoint matrix to identify exploitable preconditions.

Frequently Asked Questions about hunt-sharepoint

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I fingerprint the SharePoint Server version remotely?▼

Request /_vti_inf.html for the FPVersion banner, POST anonymously to /_api/contextinfo and read LibraryVersion, or grep version strings from /_layouts/15/start.aspx. Build 15.0.x indicates SP2013, while 16.0.x indicates SP2016, SP2019, or Subscription Edition.

How to test SharePoint Authentication.asmx for brute-force exposure?▼

First send a SOAP Mode request to confirm Forms authentication is enabled. Then send a 10-burst of login attempts with synthetic non-existent usernames; uniform timing and identical response sizes confirm no rate limit or lockout, which is reportable without cracking any credential.

What is the SharePoint ToolShell precondition chain?▼

It is the anonymous reachability of ToolPane.aspx with an empty __VIEWSTATEENCRYPTED field, an anonymously issued FormDigest from /_api/contextinfo, and an accepted anonymous POST to ToolPane.aspx with that digest. On end-of-life SP2013 this chain maps to CVE-2025-53770 with no patch available.

Is SharePoint download.aspx an SSRF vulnerability?▼

No, download.aspx is an internal SPWebApplication and SPFile path resolver, not a generic URL fetcher. The URL echo in error messages is server-side string formatting; confirm any SSRF claim with out-of-band Collaborator callbacks before reporting.

Does this methodology apply to SharePoint Online?▼

The methodology targets on-prem SharePoint Server farms. SharePoint Online requires authentication on endpoints like /_api/contextinfo and is not affected by on-prem issues like Authentication.asmx misconfiguration or EoL SP2013 exposure.

Why does Picker.aspx help enumerate SharePoint SafeControls?▼

Picker.aspx returns different error messages depending on whether a class exists but is not whitelisted versus does not exist at all. Feeding a wordlist of Microsoft.SharePoint WebControls and WebPartPages types enumerates reachable classes as recon for deserialization-chain research.

Related Skills

Explore More Software Engineering Skills→
wgpsecwgpsec
1.6k

recon-full

Enumerate subdomains, scan ports, fingerprint assets, and validate POCs.

Official
Advanced
marcboggsmarcboggs

report-writing

Writes impact-first bug bounty reports for HackerOne, Bugcrowd, Intigriti, and Immunefi with CVSS scoring.

Community
Intermediate
pdparchitectpdparchitect
13

hunt-ntlm-info

Probe internet-reachable services for NTLM information disclosure by parsing NTLMSSP Type-2 messages.

Community
Advanced
chatbotkitchatbotkit
13

hunt-aspnet

Detect ASP.NET ViewState deserialization, machineKey misconfigurations, and trace/elmah exposure.

Official
Advanced