skills.rest
uphiago
uphiagoCOMMUNITY
Explore all skills by this author →
Website𝕏@uphiagoGitHub

hunt-sharepoint

Hunt critical vulnerabilities and misconfigurations in on-prem Microsoft SharePoint Server deployments.

1.1k|191|Updated Jun 24, 2026
Search Tags:#sharepoint#red-team#cve#penetration-testing#attack-surface#on-prem#vulnerability-hunting
One-click install
npx skills add https://github.com/uphiago/recon-skills --skill hunt-sharepoint-uphiago
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-sharepoint
Source: https://github.com/uphiago/recon-skills/tree/main/redteam/hunt-sharepoint
Command: npx skills add https://github.com/uphiago/recon-skills --skill hunt-sharepoint-uphiago

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

On-prem Microsoft SharePoint Server deployments are high-value enterprise attack surfaces, but they often run end-of-life versions with unpatched CVEs, legacy protocol weaknesses, and misconfigured anonymous endpoints that are trivial to exploit if left unassessed. This Skill eliminates the guesswork of identifying these critical weaknesses by providing a field-validated, step-by-step hunting methodology tailored specifically to SharePoint's unique attack surface.

Core Features & Use Cases

  • Version Fingerprinting & CVE Mapping: Automatically map leaked SharePoint build numbers to their corresponding unpatched CVEs, with special focus on EoL 2013/2016/2019 farms where post-EoL CVEs are permanently unpatched.
  • Anonymous Endpoint Enumeration: Probe a curated list of anonymous-accessible SharePoint endpoints to discover attack vectors including legacy SOAP login bypass, ToolShell CVE-2025-53770 preconditions, NTLM AD topology disclosure, and SafeControl reflection enumeration.
  • Defense Bypass & Validation: Includes proven bypass techniques for common controls like branded login pages, WAFs, AWS ELB request smuggling, and ViewState encryption, plus a Gate 0 validation framework to ensure findings are reproducible and impactful.
  • Use Case: A red teamer targeting an enterprise dealer portal built on SharePoint 2013 can use this Skill to quickly confirm the farm is EoL, identify the anonymous Authentication.asmx login endpoint, validate the ToolShell precondition chain, and package all findings into a critical-severity bug bounty report in under 30 minutes.

Quick Start

Use the hunt-sharepoint skill to assess a target SharePoint Server URL for exposed anonymous endpoints, version-specific unpatched CVEs, and critical attack chains including legacy SOAP login bypass and ToolShell preconditions.

Frequently Asked Questions about hunt-sharepoint

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find unpatched CVEs on an on-prem SharePoint Server?▼

To find unpatched CVEs on an on-prem SharePoint Server, use version fingerprinting to map leaked build numbers to their corresponding vulnerabilities, focusing on permanently unpatched post-EoL CVEs in 2013/2016/2019 farms.

What is the best way to enumerate anonymous SharePoint endpoints during a penetration test?▼

The best way to enumerate anonymous SharePoint endpoints is probing a curated list of anonymous-accessible paths to discover attack vectors like legacy SOAP login bypass, NTLM AD topology disclosure, and SafeControl reflection enumeration.

Can I bypass WAFs and AWS ELB request smuggling when testing SharePoint attack surfaces?▼

Yes, you can bypass WAFs and AWS ELB request smuggling when testing SharePoint attack surfaces using proven bypass techniques for common controls like branded login pages and ViewState encryption included in the hunting methodology.

Does this SharePoint vulnerability hunting approach work on Subscription Edition farms?▼

Yes, this SharePoint vulnerability hunting approach works on Subscription Edition farms, as well as 2013, 2016, and 2019 deployments exposed on public or internal corporate networks for red team engagements and bug bounty programs.

How do I validate the ToolShell CVE-2025-53770 precondition chain on a target farm?▼

To validate the ToolShell CVE-2025-53770 precondition chain on a target farm, probe anonymous-accessible endpoints to identify the Authentication.asmx login endpoint and apply a Gate 0 validation framework to ensure findings are reproducible.

Related Skills

Explore More Software Engineering Skills→
EntroVyxEntroVyx
3

hunt-sharepoint

Fingerprint Microsoft SharePoint Server versions and detect authentication bypass vulnerabilities.

Community
Advanced
elementalsoulselementalsouls
3.3k

hunt-sharepoint

Enumerate anonymous endpoints, version disclosures, and misconfigurations in on-premises SharePoint deployments.

Community
Advanced
devtintdevtint

waf-bypass

Identify and bypass Web Application Firewalls during API penetration testing.

Community
Intermediate
gmh5225gmh5225
3.3k

dma-attack-techniques

Analyze PCIe DMA memory access risks using FPGA hardware in controlled labs.

Community
Advanced