hunt-sharepoint

Discover and exploit vulnerabilities in Microsoft SharePoint Server farms.

Updated Jun 24, 2026

Search Tags:#vulnerability discovery #exploitation #SharePoint #bug hunting #red teaming

Ready to run

npx skills add https://github.com/Skobyn/talon --skill hunt-sharepoint-skobyn

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: hunt-sharepoint
Source: https://github.com/Skobyn/talon/tree/main/skills/hunt-sharepoint
Command: npx skills add https://github.com/Skobyn/talon --skill hunt-sharepoint-skobyn

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill automates the discovery and exploitation of vulnerabilities in Microsoft SharePoint Server farms, providing a streamlined approach to red-teaming and bug hunting.

Core Features & Use Cases

Vulnerability Discovery: Identifies vulnerabilities in SharePoint farms, including end-of-life unpatched code paths and legacy SOAP login bypasses.
Exploitation: Provides detailed exploitation techniques for identified vulnerabilities, including the ToolShell precondition chain and NTLM Type-2 AD topology disclosure.
Use Case: For a red-team assessment, use this Skill to identify potential vulnerabilities in an on-premises SharePoint farm and attempt to exploit them.

Quick Start

Run the hunt-sharepoint skill to enumerate endpoints and identify vulnerabilities in your SharePoint farm.

Frequently Asked Questions about hunt-sharepoint

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I discover vulnerabilities in Microsoft SharePoint farms?▼

Discover SharePoint farm vulnerabilities by enumerating anonymous endpoints, extracting version disclosures, and probing legacy SOAP login bypasses. This process identifies unpatched code paths and exposed configuration issues.

What is the NTLM Type-2 AD topology disclosure in SharePoint?▼

The NTLM Type-2 AD topology disclosure is an exploitation technique that leaks Active Directory domain details. It extracts internal AD topology information by analyzing NTLM Type-2 challenge responses from SharePoint servers.

Can I exploit end-of-life unpatched SharePoint code paths?▼

Yes, you can exploit end-of-life unpatched SharePoint code paths using the ToolShell precondition chain. This technique chains specific preconditions to execute toolshell commands against deprecated legacy components.

How do I bypass legacy SOAP authentication in SharePoint?▼

Bypass legacy SOAP authentication in SharePoint by targeting deprecated web service endpoints. The Skill identifies specific SOAP login bypass vulnerabilities that allow unauthenticated access to restricted farm resources.

Does this Skill require access to SharePoint headers and paths?▼

Yes, this Skill requires access to SharePoint headers and paths to enumerate endpoints and verify versions. Header and path data are essential inputs for anonymous endpoint enumeration and vulnerability identification.

What is the ToolShell precondition chain in SharePoint exploitation?▼

The ToolShell precondition chain is a SharePoint exploitation technique that sequences specific prerequisite conditions. This chain allows attackers to achieve toolshell execution by manipulating legacy application states.