hunt-sharepoint
starsforks
How to install hunt-sharepoint?
elementalsouls/claude-bughunter/hunt-sharepoint
$npx -y skills add elementalsouls/Claude-BugHunter --skill hunt-sharepointHunt Microsoft SharePoint Server (2013/2016/2019/Subscription Edition) on-prem farms — anonymous endpoint enumeration, version disclosure, legacy SOAP login bypass (Authentication.asmx), ToolShell precondition chain (CVE-2025-53770), SafeControl reflection enumeration via Picker.
SKILL.md
| 1 | ## Crown Jewel Targets |
| 2 | |
| 3 | SharePoint Server (on-prem) is one of the richest enterprise attack surfaces in 2025-2026 bug bounty / red-team work. Three forces converge: |
| 4 | |
| 5 | 1. **End-of-life unpatched code paths.** SharePoint Server 2013 reached extended-support EoL on 2023-04-11 (final build `15.0.5545.1000` / KB5002381). Every SharePoint CVE published after that date is **permanently unpatched** on SP2013 farms. SP2016 reaches EoL 2026-07-14; SP2019 reaches EoL 2026-07-14 (next 2 months as of May 2026); only SP Subscription Edition is currently in active support. |
| 6 | 2. **CVE-2025-53770 / 53771 "ToolShell"** — July 2025 emergency-out-of-band patch chain for SPE / SP2019 / SP2016. The vulnerable code path (anonymous `/_layouts/15/ToolPane.aspx?DisplayMode=Edit` + anonymous `__REQUESTDIGEST` + unencrypted ViewState) is present in **SP2013 too** and will never receive a fix. |
| 7 | 3. **Custom branded login pages forget legacy SOAP login.** `/_vti_bin/Authentication.asmx` with the `Login` SOAP op is the SharePoint equivalent of WordPress XMLRPC bypass — accepts native Forms credentials anonymously with no rate limit on most farms even when the branded UI has lockout. |
| 8 | |
| 9 | **Highest-value SharePoint targets:** |
| 10 | |
| 11 | - **SP2013 farms still on the public internet** — every CVE since April 2023 is unpatched. Critical-severity findings. |
| 12 | - **Dealer / partner / supplier portals** built on SharePoint by enterprise integrators (German VW group, a enterprise system integrator, etc.) — high-impact business data, often nested inside corporate AD trees. |
| 13 | - **SharePoint farms with anonymous Forms-auth zones** — Authentication.asmx becomes anonymously brute-forceable. |
| 14 | - **SharePoint inside corporate AD parent forests** — NTLM Type-2 leak (see `hunt-ntlm-info`) discloses the parent forest membership. |
| 15 | - **Telerik-integrated SharePoint installations** — additional deserialization sinks on top of SP's own. |
| 16 | |
| 17 | **Asset types that pay most:** internet-reachable SP Server (any version) > SP Online with custom solutions hooks > intranet SP only after VPN compromise. |
| 18 | |
| 19 | --- |
| 20 | |
| 21 | ## Attack Surface Signals |
| 22 | |
| 23 | **Response-header fingerprints (any one is sufficient — usually multiple co-occur):** |
| 24 | ``` |
| 25 | SPRequestGuid: <GUID> (always — anonymous and authenticated) |
| 26 | X-MS-InvokeApp: 1; RequireReadOnly (SharePoint web request) |
| 27 | X-SharePointHealthScore: 0 (SharePoint specific) |
| 28 | SPIisLatency: <ms> (SharePoint internal timing) |
| 29 | SPRequestDuration: <ms> (SharePoint request duration) |
| 30 | MicrosoftSharePointTeamServices: 15.0.0.0 (often stripped by ELB — but if present, exact version) |
| 31 | X-Forms_Based_Auth_Required: <login URL> (Forms-auth zone indicator) |
| 32 | X-Forms_Based_Auth_Return_Url: <return URL> (Forms-auth zone indicator) |
| 33 | X-MSDAVEXT_Error: 917656; Access denied... (WebDAV extension active) |
| 34 | DAV: 1, 2 (WebDAV verbs supported) |
| 35 | Set-Cookie: ASP.NET_SessionId=... (always — IIS session) |
| 36 | Set-Cookie: FedAuth=...; rtFa=... (claims-mode auth) |
| 37 | Set-Cookie: WSS_FullScreenMode=... (SharePoint UI mode) |
| 38 | ``` |
| 39 | |
| 40 | **URL / path fingerprints:** |
| 41 | ``` |
| 42 | /_layouts/15/ (SP2013+ layouts root — SP2010 used /_layouts/ without the 15) |
| 43 | /_layouts/14/ (legacy SP2010 — almost EoL since 2020-10-13) |
| 44 | /_layouts/16/ (some SP2019 / SPE) |
| 45 | /_vti_bin/ (FrontPage-RPC + SOAP services) |
| 46 | /_vti_pvt/ (FrontPage-RPC config — usually 403) |
| 47 | /_vti_inf.html (almost always anonymous; contains FPVersion banner) |
| 48 | /_api/ (modern REST API) |
| 49 | /_api/$metadata (OData metadata — often anonymous + large) |
| 50 | /_api/contextinfo (FormDigest issuer — POST only) |
| 51 | /_catalogs/ (site catalogs: masterpage, wp, lt, theme, solutions) |
| 52 | /_catalogs/users/simple.aspx (user list — usually 403) |
| 53 | /_layouts/15/start.aspx (anonymous landing — leaks version) |
| 54 | /_layouts/15/ToolPane.aspx (web part editor — ToolShell sink) |
| 55 | /_layouts/15/Picker.aspx (people/list picker — SafeControl recon) |
| 56 | /_layouts/15/downl |
People who liked this also viewed
6 picksType
- entra-app-registrationGuides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API perSkillsJul 2026
- azure-complianceRun Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: SkillsJul 2026
- azure-rbacOfficial agent plugin providing skills and MCP server configurations for Azure scenarios.SkillsJul 2026
- better-auth-best-practicesAgent skill from better-auth/skillsSkillsJul 2026
- firebase-security-rules-auditorA skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.SkillsJul 2026
- audit-websiteAudit a website with the squirrelscan CLI and fix the findings in code. Runs SEO, performance, security, technical, content, accessibility, and 15 other rule categories (260+ rules), returns an LLM-opSkillsJul 2026
