Skip to content
attack.paths
Connexion
← RegistryDossier · 4 steps · 3 edges

SharePoint / OneDrive public link enumeration → data dump

Bing / Grayhat Warfare reveals corporate SharePoint files shared 'with anyone' — financial docs, contracts, credentials in plaintext, etc.

Filed by AD Knowledge Base
§ Kill-chainDrag · zoom · scroll

§ Context

Assumed environment: target has at least one SharePoint or OneDrive document mistakenly shared with 'anyone with the link', and that link has been indexed (linked from email signatures, status pages, etc.).

§ Steps

  1. 01
    Bulk-download exposed filesExfiltration
    T1041— Exfiltration Over C2 Channel
  2. 02
    Grep for passwords / cloud keysReconnaissance
    W-RECON-JS-SECRETS— Hardcoded Secrets in JS Bundles
  3. 03
    Bing site:*.sharepoint.com inurl:shareReconnaissance
    W-RECON-GITHUB-DORK— GitHub / GitLab Dorking
  4. 04
    Locate public-share URLsCollection
    M365-SHAREPOINT-LEAK— SharePoint / OneDrive External Sharing

§ References

§ Frequently asked

What is the "SharePoint / OneDrive public link enumeration → data dump" attack path?
Bing / Grayhat Warfare reveals corporate SharePoint files shared 'with anyone' — financial docs, contracts, credentials in plaintext, etc. It chains 4 steps drawn from real-world offensive-security techniques.
What starting position does this attack require?
The first step is Bulk-download exposed files (T1041) — a exfiltration primitive. Assumed environment: target has at least one SharePoint or OneDrive document mistakenly shared with 'anyone with the link', and that link has been indexed (linked from email signatures, status pages, etc.
What is the final impact of this kill-chain?
The final step lands on Locate public-share URLs (M365-SHAREPOINT-LEAK), which falls under Collection. From here, an operator typically pivots into post-exploitation or maintains persistence.
How can defenders detect or prevent this attack?
Detection and prevention vary per step. Refer to each linked MITRE ATT&CK entry under "References" — every technique on that page lists defensive controls, detection telemetry, and known threat-actor usage.

§ Related dossiers