id: sharepoint-exposed-login-endpoint

info:
  name: Microsoft SharePoint - Exposed Login Endpoint
  author: pussycat0x
  severity: info
  description: |
    Detected Microsoft SharePoint login and authentication endpoints.
  reference:
    - https://learn.microsoft.com/en-us/sharepoint/authentication
    - https://learn.microsoft.com/en-us/sharepoint/security-for-sharepoint-server/plan-for-administrative-and-service-accounts
    - https://github.com/danielmiessler/SecLists/blob/master/Discovery/Web-Content/CMS/Sharepoint-Ennumeration.txt
  metadata:
    verified: true
    max-request: 2
    shodan-query: http.component:"Microsoft SharePoint"
    fofa-query: app="Microsoft-SharePoint"
    product: sharepoint
    vendor: microsoft
  tags: sharepoint,microsoft,login,exposure,misconfig,panel,tech

http:
  - method: GET
    path:
      - "{{BaseURL}}/_layouts/15/Authenticate.aspx"
      - "{{BaseURL}}/_layouts/Authenticate.aspx"

    stop-at-first-match: true
    host-redirects: true
    max-redirects: 2

    matchers-condition: and
    matchers:
      - type: regex
        part: header
        regex:
          - "(?i)MicrosoftSharePointTeamServices"

      - type: status
        status:
          - 401
# digest: 4a0a00473045022100d27009dd96f18baea063c2b135766fbf8555af356f43a201de967130870f6ff90220335bb47d13ffe9fdfb79f970881a671fcde011c12e91046db1590e7584e3b05d:922c64590222798bb761d5b6d8e72950