When the scanner runs, here are the tests performed:
- Gather information about the SharePoint version installed
- Analyze SharePoint configuration settings
- Verify public exposure of SharePoint web services
- Attempt to do user enumeration
- Check permissions on default SharePoint _layouts, _catalogs, and forms
- Find juicy information indexed by Google about the target
The SharePoint security assessment is performed remotely in a black-box manner. The scan results explain findings from an anonymous user's perspective who accesses the target website.
|Target URL||This is the URL of the SharePoint website that will be scanned. All URLs must start with |
The scanner connects to the target SharePoint server and tries to retrieve certain default pages, discovering known vulnerabilities.
Furthermore, the HTTP response headers received from the server are also analyzed to find security issues.