I have "abused" this myself, there is a nice blackhat talk about just this along with a tool to help figure out where principals have been granted permission: h

I have "abused" this myself, there is a nice blackhat talk about just this along with a tool to help figure out where principals have been granted permission: https://www.youtube.com/watch?v=Ml09R38jpok https://www.youtube.com/watch?v=Ml09R38jpok