PowerShell SharePoint extraction + auditing tool for red/blue/purple teams. Enumerates all SharePoint sites/drives a user can access via Microsoft Graph, recursively downloads files, and logs every Graph + SharePoint HTTP request for SIEM correlation, detection engineering, and IR testing.
SharePointDumper is a PowerShell-based extraction and auditing utility that enumerates SharePoint sites a user can access via Microsoft Graph and downloads files via SharePoint.
It is designed for SOC / DLP testing, purple teaming, and non-sophisticated red-team assessments, and therefore produces detailed reports including downloaded files and every HTTP request (Graph + SharePoint) for SIEM correlation.
The tool does not perform authentication. Instead, it requires an already obtained OAuth2 access token with the appropriate Microsoft Graph permissions (Sites.Read.All or Sites.ReadWrite.All).
If you need help obtaining such a token, you can use EntraTokenAid (examples included below), which simplifies generating usable access tokens.
Execution:
Example CSV API Log (can be CSV or JSON):
Example File Download Log (can be CSV or JSON)
git clone https://github.com/zh54321/SharePointDumper.git
cd SharePointDumper
SharePointDumper requires a valid Microsoft Graph access token with delegated permissions to enumerate sites and files:
Sites.Read.All orSites.ReadWrite.AllFurthermore, the OAuth client must be allowed to call SharePoint API.
More than 23 Microsoft first-party applications already have pre-consented Sites.Read… permissions. They can download files from SharePoint, and can be used to obtain a valid token without additional tenant configuration.