一份针对漏洞赏金、Web应用程序安全性和渗透测试的Google Dorks（Hacking）列表

这份指南用得好，绝对能回买这本书的钱，推荐！攻防对抗从信息收集开始，这就是外行人也能掌握的信息收集技巧。

广域搜索,负向搜索

site:example.com -www -shop -share -ir -mfa

带参数的PHP扩展

site:example.com ext:php inurl:?

API端点

site:example[.]com inurl:api | site:*/rest | site:*/v1 | site:*/v2 | site:*/v3

丰富的扩展名

site:"example[.]com" ext:log | ext:txt | ext:conf | ext:cnf | ext:ini | ext:env | ext:sh | ext:bak | ext:backup | ext:swp | ext:old | ext:~ | ext:git | ext:svn | ext:htpasswd | ext:htaccess | ext:json

inurl关键词

inurl:conf | inurl:env | inurl:cgi | inurl:bin | inurl:etc | inurl:root | inurl:sql | inurl:backup | inurl:admin | inurl:php site:example[.]com

服务器错误

inurl:"error" | intitle:"exception" | intitle:"failure" | intitle:"server at" | inurl:exception | "database error" | "SQL syntax" | "undefined index" | "unhandled exception" | "stack trace" site:example[.]com

易受XSS攻击的参数

inurl:q= | inurl:s= | inurl:search= | inurl:query= | inurl:keyword= | inurl:lang= inurl:& site:example.com

易受开放重定向影响的参数

inurl:url= | inurl:return= | inurl:next= | inurl:redirect= | inurl:redir= | inurl:ret= | inurl:r2= | inurl:page= inurl:& inurl:http site:example.com

易受SQL注入影响的参数

inurl:id= | inurl:pid= | inurl:category= | inurl:cat= | inurl:action= | inurl:sid= | inurl:dir= inurl:& site:example.com

易受SSRF影响的参数

inurl:http | inurl:url= | inurl:path= | inurl:dest= | inurl:html= | inurl:data= | inurl:domain=  | inurl:page= inurl:& site:example.com

易受LFI影响的参数

inurl:include | inurl:dir | inurl:detail= | inurl:file= | inurl:folder= | inurl:inc= | inurl:locate= | inurl:doc= | inurl:conf= inurl:& site:example.com

易受RCE影响的参数

inurl:cmd | inurl:exec= | inurl:query= | inurl:code= | inurl:do= | inurl:run= | inurl:read=  | inurl:ping= inurl:& site:example.com

文件上传点

site:example.com “选择文件”

API文档

inurl:apidocs | inurl:api-docs | inurl:swagger | inurl:api-explorer site:"example[.]com"

登录页面

inurl:login | inurl:signin | intitle:login | intitle:signin | inurl:secure site:example[.]com

测试环境

inurl:test | inurl:env | inurl:dev | inurl:staging | inurl:sandbox | inurl:debug | inurl:temp | inurl:internal | inurl:demo site:example.com

敏感文档

site:example.com ext:txt | ext:pdf | ext:xml | ext:xls | ext:xlsx | ext:ppt | ext:pptx | ext:doc | ext:docx
intext:“机密” | intext:“不得公开发布” | intext:”仅限内部使用” | intext:“不得分发”

敏感参数

inurl:email= | inurl:phone= | inurl:password= | inurl:secret= inurl:& site:example[.]com

Adobe Experience Manager (AEM)

inurl:/content/usergenerated | inurl:/content/dam | inurl:/jcr:content | inurl:/libs/granite | inurl:/etc/clientlibs | inurl:/content/geometrixx | inurl:/bin/wcm | inurl:/crx/de site:example[.]com

披露的XSS和开放重定向

site:openbugbounty.org inurl:reports intext:"example.com"

Google群组

site:groups.google.com "example.com"

代码泄露

site:pastebin.com "example.com"

site:jsfiddle.net "example.com"

site:codebeautify.org "example.com"

site:codepen.io "example.com"

云存储

site:s3.amazonaws.com "example.com"

site:blob.core.windows.net "example.com"

site:googleapis.com "example.com"

site:drive.google.com "example.com"

site:dev.azure.com "example[.]com"

site:onedrive.live.com "example[.]com"

site:digitaloceanspaces.com "example[.]com"

site:sharepoint.com "example[.]com"

site:s3-external-1.amazonaws.com "example[.]com"

site:s3.dualstack.us-east-1.amazonaws.com "example[.]com"

site:dropbox.com/s "example[.]com"

site:box.com/s "example[.]com"

site:docs.google.com inurl:"/d/" "example[.]com"

JFrog Artifactory

site:jfrog.io "example[.]com"

Firebase

site:firebaseio.com "example[.]com"

不带域名时效果更好的Dorks

漏洞赏金计划和漏洞披露计划

"提交漏洞报告" | "由Bugcrowd提供支持" | "由HackerOne提供支持"

site:*/security.txt "bounty"

暴露的Apache服务器状态

site:*/server-status apache

WordPress

inurl:/wp-admin/admin-ajax.php

Drupal

intext:"由" & intext:Drupal & inurl:user

Joomla

site:*/joomla/login

更多Dorks的Medium文章：

https://thegrayarea.tech/5-google-dorks-every-hacker-needs-to-know-fed21022a906

https://infosecwriteups.com/uncover-hidden-gems-in-the-cloud-with-google-dorks-8621e56a329d

https://infosecwriteups.com/10-google-dorks-for-sensitive-data-9454b09edc12

顶级参数：

https://github.com/lutfumertceylan/top25-parameter

Proviesec dorks:

https://github.com/Proviesec/google-dorks