Classic SharePoint Online REST access from a client with outbound Internet HTTPS access to the tenant service endpoint. curl can issue a HEAD request to a known site URL and, with a valid bearer token and list-read permission, retrieve items from one named list. These requests need no internal execution foothold and do not enumerate sites; this record describes API access, not a standalone exploitation toolkit.
RESTRICTED_ACCESS_BLUR_MARKER