skills.rest
sseshachala
sseshachalaCOMMUNITY
Explore all skills by this author →
GitHub

hunt-sharepoint

Fingerprint on-prem SharePoint deployments to identify version and vulnerability vectors.

Updated Jun 5, 2026
Search Tags:#reconnaissance#sharepoint#on-prem#ntlm#toolshell#authentication-asmx#safecontrol
One-click install
npx skills add https://github.com/sseshachala/Claude-BugHunter-archive --skill hunt-sharepoint-sseshachala
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-sharepoint
Source: https://github.com/sseshachala/Claude-BugHunter-archive/tree/main/skills/hunt-sharepoint
Command: npx skills add https://github.com/sseshachala/Claude-BugHunter-archive --skill hunt-sharepoint-sseshachala

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

SharePoint on-prem farms (SP2013/2016/2019/SubEdition) often expose dangerous misconfigurations and legacy vectors that attackers or red-team operators can exploit. This Skill provides structured discovery, risk mapping, and practical steps to identify anonymous endpoint exposure, ToolShell preconditions, NTLM topology leaks, and custom-branding module surfaces.

Core Features & Use Cases

  • Anonymous endpoint enumeration across /_layouts/15, /_vti_bin, /_api, and /_catalogs/ to map version, surface exposure, and preconditions.
  • ToolShell precondition chain testing (CVE-2025-53770) to validate potential RCE surfaces in legacy SP2013 and later.
  • SafeControl reflection reconnaissance via Picker.aspx to enumerate reachable classes for post-exploitation chaining.
  • NTLM Type-2 topology disclosure to understand AD forest relationships and attacker recon.
  • Custom-branding module discovery to assess ongoing maintenance and exposure.

Quick Start

Run an anonymous scan against a target SharePoint on-prem farm to enumerate endpoints, verify ToolShell preconditions, and identify potential NTLM topology signals.

Frequently Asked Questions about hunt-sharepoint

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I fingerprint an on-prem SharePoint farm to identify version and exposure?▼

Fingerprinting on-prem SharePoint involves probing endpoints like _vti_inf.html, _layouts/15/start.aspx, and _vti_bin/Authentication.asmx to map version, surface exposure, and vulnerability vectors across SP2013/2016/2019 and Subscription Edition farms.

What is the ToolShell precondition chain in SharePoint reconnaissance?▼

The ToolShell precondition chain tests legacy SharePoint surfaces to validate potential RCE vectors associated with CVE-2025-53770, helping identify exploitable misconfigurations in SP2013 and later deployments.

Can I use this SharePoint reconnaissance against Subscription Edition farms?▼

Yes, this SharePoint reconnaissance applies to SP2013, SP2016, SP2019, and Subscription Edition farms on both internet-facing and internal networks during authorized security engagements.

How do I enumerate anonymous endpoint exposure on a SharePoint server?▼

Enumerate anonymous endpoint exposure by probing /_layouts/15, /_vti_bin, /_api, and /_catalogs/ paths to map version, surface exposure, and preconditions for potential exploitation.

What are the limitations of SharePoint on-prem reconnaissance?▼

SharePoint on-prem reconnaissance is limited to authorized engagements and requires safe probing of specific endpoints to avoid disruption while mapping CVE surfaces and custom-branding module exposures.

Related Skills

Explore More Data & Analytics Skills→
VenTheZoneVenTheZone
1

hack-scope

Analyze VDP documentation to define security assessment scope boundaries.

Community
Intermediate
Kisilev13Kisilev13

hunt-sharepoint

Enumerate SharePoint Server attack surfaces and demonstrate CVE-2025-53770 exploitation.

Community
Advanced
uphiagouphiago
1.1k

hunt-ntlm-info

Capture anonymous NTLM Type-2 challenges from IIS, SharePoint, and Exchange endpoints.

Community
Intermediate
pdparchitectpdparchitect
13

hunt-aspnet

Detect ASP.NET security vulnerabilities including ViewState deserialization and configuration disclosure.

Community
Advanced