skills.rest
hhjkjkjk
hhjkjkjkCOMMUNITY
Explore all skills by this author →
GitHub

hunt-sharepoint

Enumerate and assess on-prem SharePoint Server farms for anonymous endpoints and known CVE preconditions.

Updated May 29, 2026
Search Tags:#penetration testing#sharepoint#enumeration#bug bounty#soap#ntlm#cve-2025-53770
One-click install
npx skills add https://github.com/hhjkjkjk/Claude-skills --skill hunt-sharepoint-hhjkjkjk
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-sharepoint
Source: https://github.com/hhjkjkjk/Claude-skills/tree/main/skills/hunt-sharepoint
Command: npx skills add https://github.com/hhjkjkjk/Claude-skills --skill hunt-sharepoint-hhjkjkjk

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Security testers assessing internet-facing Microsoft SharePoint Server farms need a structured methodology to fingerprint versions, enumerate anonymous endpoints, and validate high-impact vulnerability preconditions (such as the CVE-2025-53770 ToolShell chain) without wasting time on false positives like misidentified SSRF. ## Core Features & Use Cases - Version Fingerprinting & CVE Mapping: Extract exact build numbers via _vti_inf.html, /_api/contextinfo, and start.aspx, then map them against the end-of-life CVE matrix for SP2013/2016/2019/Subscription Edition. - Anonymous Attack-Surface Enumeration: Probe a defined matrix of /_layouts/15/, /_vti_bin/, and /_api/ endpoints, including the Authentication.asmx legacy SOAP login bypass and Picker.aspx SafeControl reflection enumeration. - ToolShell Precondition Validation: Verify the three-step CVE-2025-53770 precondition chain (anonymous ToolPane.aspx GET, anonymous FormDigest issuance, digest-authorized POST) as reportable evidence without delivering exploit payloads. - Use Case: During an authorized engagement against an EoL SharePoint 2013 portal, follow the methodology to confirm anonymous Authentication.asmx brute-force exposure, NTLM Type-2 AD topology disclosure, and the ToolShell precondition chain, then rate each finding with the Gate 0 severity rubric. ## Quick Start Ask the AI to fingerprint the SharePoint version of an authorized target and walk the anonymous-endpoint matrix to identify exploitable preconditions.

Frequently Asked Questions about hunt-sharepoint

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I fingerprint the SharePoint Server version anonymously?▼

Request /_vti_inf.html for the FPVersion banner, POST to /_api/contextinfo and read LibraryVersion, or grep version strings from /_layouts/15/start.aspx. Build 15.0.5545.1000 indicates the final EoL SharePoint 2013 cumulative update.

What is the SharePoint Authentication.asmx login bypass?▼

The legacy SOAP endpoint /_vti_bin/Authentication.asmx accepts anonymous Login calls with Forms credentials even when the branded login page enforces lockout, CAPTCHA, or MFA. Confirm Mode returns Forms, then test with synthetic users to verify no rate limiting exists.

How do I test the CVE-2025-53770 ToolShell precondition chain?▼

Check three conditions: anonymous GET on ToolPane.aspx?DisplayMode=Edit returns __VIEWSTATEENCRYPTED empty, anonymous POST to /_api/contextinfo returns a valid FormDigest, and an anonymous POST to ToolPane.aspx with that digest returns 200. Do not deliver a malicious ViewState payload.

Is SharePoint download.aspx?SourceUrl= an SSRF vulnerability?▼

No, download.aspx is an SP-internal path resolver, not a generic URL fetcher. The URL echo in error messages is server-side string formatting; confirm any SSRF claim with out-of-band Collaborator callbacks before reporting.

Which SharePoint versions are affected by unpatched CVEs after end-of-life?▼

SharePoint 2013 reached end-of-life on 2023-04-11, so every CVE published after that date is permanently unpatched, including CVE-2023-29357 and CVE-2025-53770. SP2016 and SP2019 reach end-of-life on 2026-07-14.

When should SharePoint findings not be reported as critical?▼

Do not report download.aspx URL echoes as SSRF without out-of-band confirmation, and treat EoL exposure alone as medium-low hygiene rather than critical. Critical severity requires demonstrated unbounded credential validation or a full ToolShell precondition chain.

Related Skills

Explore More Software Engineering Skills→
wgpsecwgpsec
1.6k

recon-full

Enumerate subdomains, scan ports, fingerprint assets, and validate POCs.

Official
Advanced
mlvpatelmlvpatel
1

verdict-gate

Validate bug bounty submissions against a 7-question gate and four pre-submission checks.

Community
Advanced
uphiagouphiago
1.1k

hunt-ntlm-info

Capture anonymous NTLM Type-2 challenges from IIS, SharePoint, and Exchange endpoints.

Community
Intermediate
cybersecwomancybersecwoman
5

hunt-aspnet

Identify and exploit ASP.NET vulnerabilities like ViewState deserialization and machineKey recovery.

Community
Advanced