SharePointDumper is a PowerShell utility that enumerates and downloads all SharePoint content reachable by a given OAuth2 identity, built for authorized SOC, DLP, and purple-team validation exercises.
| Tool | zh54321/SharePointDumper — PowerShell SharePoint enumeration and bulk-download utility built on Microsoft Graph, aimed at DLP and purple-team testing |
| Category | Cloud / SaaS data-exposure auditing (PowerShell) |
| Primary Use | Enumerating every SharePoint site, drive, folder, and file an identity can reach via Microsoft Graph, then bulk-downloading within operator-defined limits during authorized assessments |
| Safe Use | Use only in tenants you own or have written authorization to test — SOC/DLP control validation, purple-team exercises, and internal audits of permission hygiene; never against third-party environments |
| Telemetry Note | Every Graph and SharePoint HTTP request is logged to CSV or JSON for SIEM correlation; defenders should watch bulk Graph enumeration patterns, unusual first-party app client IDs, and anomalous download volumes from single identities |
SharePointDumper is a PowerShell-based extraction and auditing utility from zh54321 that answers a deceptively simple question: what can one identity actually read in a SharePoint tenant? It enumerates every site, drive, folder, and file reachable through Microsoft Graph, then recursively downloads content via SharePoint pre-authentication URLs. The README frames it explicitly for SOC and DLP testing, purple teaming, and what it calls non-sophisticated red-team assessments — in other words, it simulates what a moderately capable insider or compromised account can exfiltrate without any exploit at all. At roughly 190 stars and MIT-licensed, it is an active, documented project worth understanding from both the offensive-validation and detection sides.
The most important architectural decision is that the tool performs no authentication itself. It requires an already-obtained OAuth2 access token carrying delegated Sites.Read.All or Sites.ReadWrite.All Graph permissions, plus a client allowed to call the SharePoint API. This clean separation keeps SharePointDumper focused purely on enumeration and download logic, and it also means the interesting tradecraft lives upstream, in token acquisition. For token generation the author points to a companion project, EntraTokenAid, which the README says requests CAE-enabled tokens by default.
The README's most operationally significant disclosure is a table of more than 23 Microsoft first-party applications whose client IDs already have pre-consented Sites.Read… permissions in typical tenants — Microsoft Teams, Outlook Mobile, OneDrive, the SharePoint apps, Azure OpenAI Studio, Microsoft Loop, and others. The implication for defenders is uncomfortable: an attacker holding stolen session material or a phishing-consented flow does not need a rogue app registration. They can authenticate as an existing, trusted first-party client that nobody has conditioned detection rules on. Most of the listed clients are marked FOCI-capable, several are not, and the table includes redirect URIs — the sort of inventory that blue teams should mirror into their own baselines of expected client IDs.
Running the tool is deliberately straightforward: .\Invoke-SharePointDumper.ps1 -AccessToken $accesstoken is the minimal invocation, with -UserAgent allowing the operator to replace the default SharePointDumper string. Installation is nothing more than git clone https://github.com/zh54321/SharePointDumper.git. There are no external dependencies — no Microsoft Graph PowerShell modules, no NuGet packages — which means the whole tool is auditable by reading a single script. That dependency-free design also makes it trivially portable into a lab or assessment VM.
Operationally, the tool exposes sane guardrails that matter in authorized engagements. Global download limits via -MaxFiles and -MaxTotalSizeMB bound the blast radius of a run, while -IncludeSites/-ExcludeSites and -IncludeExtensions/-ExcludeExtensions scope the exercise to, say, only pdf and docx in a Finance site when testing DLP policies. Throttling is supported through -RequestDelaySeconds with a -Variation parameter adding random jitter, and a -Proxy flag lets traffic route through something like http://127.0.0.1:8080 for inspection. Each of these knobs maps directly onto a detection question: can your SIEM see slow, jittered, extension-filtered Graph enumeration?
Two reliability features stand out as evidence of mature engineering. Resume mode (-Resume with -OutputFolder pointing at the previous run's folder) re-enumerates but skips already-downloaded files, which is essential when tokens expire mid-dump. Automatic token refresh goes further: paired with EntraTokenAid via -RefreshToken and -RefreshClientId, the tool silently recovers from HTTP 401 responses. Notably, the README states that refresh attempts are not written to the API log — a small gap that auditors reviewing the tool's own logs should keep in mind, though the traffic remains visible to tenant-side telemetry. On token lifetime, the README recommends CAE-enabled tokens valid up to 24 hours for long-running jobs.
For blue and purple teams, the reporting layer is the real selling point. Every run produces a structured report covering duration, limits, filters, and the source public IP (with an optional ifconfig.me lookup unless -DisableIpLookup is set), plus complete HTTP request logs in CSV or JSON covering both Graph and SharePoint traffic, and a file-download log. SharePoint download tokens are redacted by default, with an opt-in to log them raw. This is effectively a self-documenting attack simulation: ingest the logs into your SIEM, correlate them against what your detections actually fired on, and you have an empirical DLP gap analysis rather than a theoretical one.
The graceful Ctrl+C handling deserves a mention because it shapes the forensic picture. Interrupting a run does not lose the report — the tool finishes the current file and writes the full report and HTTP log before exiting. From a defensive standpoint that means an operator who aborts mid-exfiltration still leaves a complete record of everything attempted, assuming the logs survive on the assessment host. Conversely, an incident responder should not assume a partial run means partial evidence.
Defensively, the telemetry this tool generates is distinctive when you know what to look for. A single identity issuing broad site and drive enumeration through Graph, followed by sequential file downloads spread across many site collections, at a steady pace with jitter, from a first-party client ID associated with a device the user doesn't normally use — that combination is the signature the tool exists to test. Because downloads go through SharePoint pre-authentication URLs, watch those endpoints specifically. The customizable User-Agent is a reminder that string-based detection on tool names is trivially bypassed; behavioral detection on volume, sequencing, and client identity is the durable control.
Where does this fit in a professional workflow? It is squarely a validation instrument: run it in a test tenant, or under explicit authorization in production, to measure whether overly broad Sites.Read.All grants, legacy site permissions, or missing DLP content inspection would let a single compromised account walk out with the document estate. It also doubles as an excellent purple-team artifact generator — the full HTTP logs let you build and tune detections against realistic Graph abuse without ever needing a real adversary. Used outside authorization it is straightforward data theft, which is precisely why understanding its footprint matters. As an educational analysis of a documented open-source project, this writeup covers capability and detection surface only; operational use belongs to credentialed professionals inside their own tenants.
zh54321/SharePointDumper.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.