信息收集

组织结构

基本信息

• https://www.qcc.com
• https://aiqicha.baidu.com
• https://www.tianyancha.com

供应商

• https://t.qcc.com/home
• https://www.jrzb001.com

域名资产

Whois

• http://whois.chinaz.com
• https://whois.aliyun.com
• https://whois.aizhan.com

子域名

• 在线查询

https://crt.sh
https://chaziyu.com
https://www.dnsscan.cn
https://dnsdumpster.com
https://phpinfo.me/domain
https://rapiddns.io/subdomain
https://searchdns.netcraft.com
https://dns.bufferover.run/dns?q=

• subfinder

cat target.txt | subfinder -nW -all -silent -o domain.txt

旁站查询

• https://chapangzhan.com
• https://rapiddns.io/sameip
• https://stool.chinaz.com/same
• https://tools.ipip.net/ipdomain.php

备案查询

• http://www.beian.gov.cn
• https://beian.miit.gov.cn

主机信息

端口扫描

• 在线扫描

https://www.aicesu.cn/port
https://portscanner.standingtech.com
https://www.ipfingerprints.com/portscan.php

• naabu

cat target.txt | naabu -p 22,23,80,135,443,389,445,873,1090,1099,1433,1521,2375,3306,3389,5432,5900,5985,6379,7001,7002,8000-9000,9200 -ping -stats -silent -retries 1 -o port.txt

应用服务

Web指纹

• 在线查询

https://whatcms.org
https://www.yunsee.cn
https://www.godeye.vip
https://fp.shuziguanxing.com

• httpx

cat target.txt | httpx -sc -td -fr -nc -title -silent -o url.txt

• 浏览器插件

  Wapplyzer、WhatRuns

WAF识别

wafw00f http://example.com

目录探测

• gobuster

gobuster dir -u https://example.com -w dict.txt -k --random-agent

APP/公众号

• https://www.qimai.cn
• https://play.google.com
• https://weixin.sogou.com
• https://www.tianyancha.com

搜索引擎

FOFA

GitHub

Google

site:example.com intitle:管理|后台|登录|系统|测试
site:example.com filetype:doc|xls|sql|log|conf|json
site:example.com intext:*mail|Powered|Password|默认密码
site:example.com inurl:admin|login|system|upload|editor