SharePointDumper

SharePointDumper is a PowerShell-based extraction and auditing utility that enumerates SharePoint sites a user can access via Microsoft Graph and downloads files via SharePoint.

It is designed for SOC / DLP testing, purple teaming, and non-sophisticated red-team assessments, and therefore produces detailed reports including downloaded files and every HTTP request (Graph + SharePoint) for SIEM correlation.

The tool does not perform authentication. Instead, it requires an already obtained OAuth2 access token with the appropriate Microsoft Graph permissions (Sites.Read.All or Sites.ReadWrite.All).
If you need help obtaining such a token, you can use EntraTokenAid (examples included below), which simplifies generating usable access tokens.

✨ Features

• Enumerates SharePoint sites, drives, folders, and files via Microsoft Graph
• Recursively dumps drives and folders (using SharePoint pre-authentication URLs)
• No mandatory external dependencies (no Microsoft Graph PowerShell modules etc.)
• Customize the User-Agent
• Global download limits: max files & max total size
• Include/exclude filtering for sites and file extensions
• Adjustable request throttling with random jitter
• Optional public-IP lookup
• Supports simple HTTP proxy
• Structured report including:
  • Summary (duration, limits, filters, public IP)
  • Accessed SharePoint sites
  • Complete HTTP request logs (CSV or JSON)
• Redaction of SharePoint download tokens, with an option to log them unredacted
• Graceful Ctrl+C handling that stops after the current file and still writes the full report and HTTP log before exiting
• Resume mode, which re-enumerates but skips already downloaded files
• Optional automatic access token refresh (requires EntraTokenAid https://github.com/zh54321/EntraTokenAid.git)

📦 Pictures

Execution:

Example CSV API Log (can be CSV or JSON):

Example File Download Log (can be CSV or JSON)

📦 Installation

Clone the repository

git clone https://github.com/zh54321/SharePointDumper.git
cd SharePointDumper

🔑 Requirements

SharePointDumper requires a valid Microsoft Graph access token with delegated permissions to enumerate sites and files:

• Sites.Read.All or
• Sites.ReadWrite.All

Furthermore, the OAuth client must be allowed to call SharePoint API.

More than 23 Microsoft first-party applications already have pre-consented Sites.Read… permissions. They can download files from SharePoint, and can be used to obtain a valid token without additional tenant configuration.

Token lifetime recommendation

If possible, use a CAE-enabled access token, which remains valid for up to 24 hours and reduces interruptions during long-running dumps.

Obtaining a token with EntraTokenAid

You can use EntraTokenAid to obtain a suitable access token via PowerShell
(CAE tokens are requested by default):

# Clone the module
git clone https://github.com/zh54321/EntraTokenAid.git
Import-Module EntraTokenAid/EntraTokenAid.psm1

# Get the the tokens
$tokens = Invoke-Auth -ClientID 'b26aadf8-566f-4478-926f-589f601d9c74' -RedirectUrl 'urn:ietf:wg:oauth:2.0:oob'

# Optional: Store in variable which is compatible with the examples below
$AccessToken = $tokens.access_token

🚀 Usage

Basic usage

.\Invoke-SharePointDumper.ps1 -AccessToken $accesstoken -UserAgent "Not SharePointDumper"

Filter sites

.\Invoke-SharePointDumper.ps1 -AccessToken $accesstoken -IncludeSites "Finance","Projects"

.\Invoke-SharePointDumper.ps1 -AccessToken $accesstoken -ExcludeSites "HR","Legal"

Filter file extensions

.\Invoke-SharePointDumper.ps1 -AccessToken $accesstoken -IncludeExtensions pdf,docx

.\Invoke-SharePointDumper.ps1 -AccessToken $accesstoken -ExcludeExtensions jpg,bmp

Limit downloads

.\Invoke-SharePointDumper.ps1 -AccessToken $accesstoken -MaxFiles 500

.\Invoke-SharePointDumper.ps1 -AccessToken $accesstoken -MaxTotalSizeMB 100

Slow down requests

.\Invoke-SharePointDumper.ps1 -AccessToken $accesstoken -RequestDelaySeconds 2

With jitter:

.\Invoke-SharePointDumper.ps1 -AccessToken $accesstoken -RequestDelaySeconds 2 -Variation 3

Resume (example after token expiration)

.\Invoke-SharePointDumper.ps1 -AccessToken $accesstoken -Resume -OutputFolder .\20251121_1551_MyTenant

In resume mode, -OutputFolder must point to your previous run’s folder.

Using Automatic Token Refresh

SharePointDumper can automatically refresh an expired access token (HTTP 401) using a refresh token and EntraTokenAid.

# Mandatory: The module must be imported so the tool can use the Invoke-Refresh command
Import-Module .\EntraTokenAid\EntraTokenAid.psm1

# Optional: Obtain tokens using EntraTokenAid (other methods are also possible)
$tokens = Invoke-Auth -ClientId 'b26aadf8-566f-4478-926f-589f601d9c74' -RedirectUrl 'urn:ietf:wg:oauth:2.0:oob'

# Run SharePointDumper with refresh support
.\Invoke-SharePointDumper.ps1 -AccessToken $tokens.access_token -RefreshToken $tokens.refresh_token -RefreshClientId 'b26aadf8-566f-4478-926f-589f601d9c74'

Note: Token refresh attempts are NOT logged in the API log.

Parameters

🧾 Output Structure

Directory structure

20261115_MySecureTenant/
 ├── SharePointDumper_Report_20261115_080333.txt
 ├── SharePointDumper_ApiLog_20261115_080333.csv
 ├── SharePointDumper_FileLog_20261115_080333.csv
 ├── Site A/
 │    └── Documents/
 │         ├── file1.docx
 │         └── file2.pdf
 └── Site B/
      └── Site Assets/

Logs

• Report: high-level summary (Report_*.txt)
• API Log: every Graph + SharePoint HTTP request
  (ApiLog_*.csv or .json)
• Resume runs generate:
  • SharePointDumper_ReportResume_*
  • SharePointDumper_ApiLogResume_*

⚠️ Authentication Errors

401 – Unauthorized

Access Token is invalid or expired.

403 – Forbidden

Access Token is valid, but missing required Microsoft Graph or SharePoint permissions.

🔍 Detection

SharePointDumper activities are logged in:

• Unified Audit Log (UAL): logs SharePoint search and download activity.
• Graph Activity Logs: record all site and drive enumeration requests (/organization, /sites, /drives).

Example UAL:

Example Graph Activity Log:

📝 License

Released under the MIT License.