资产收集常用工具以及思路总结

https://beian.miit.gov.cn/#/Integrated/index

http://icp.chinaz.com/

https://zh.subdomains.whoisxmlapi.com/lookup

https://pentest-tools.com/information-gathering/find-subdomains-of-domain

项目地址：https://github.com/shmilylty/OneForAll

https://site.ip138.com/ip/domain.htm

https://hackertarget.com/find-dns-host-records/

https://searchdns.netcraft.com/

http://viewdns.info/

https://github.com/knownsec/ksubdomainhttps://github.com/FeeiCN/ESDhttps://github.com/Lijijie/subDomiansBrute

（1）crtsh：https://crt.sh/（2）facebook：https://developers.facebook.com/tools/ct（3）entrust：https://www.entrust.com/ct-search/（4）certspotter：https://sslmate.com/certspotter/api/（5）spyse：https://spyse.com/search/certificate（6）censys：https://censys.io/certificates（7）google：https://google.com/transparencyreport/https/ct/

（1）http://whois.chinaz.com/ 站长之家（2）https://whois.aliyun.com/ 阿里云域名信息查询（3）https://www.whois365.com/cn/ 全球whois查询

site:网址    //搜索指定的域名的网页内容 、可以用来搜索子域名、跟此域名相关的内容

site:sohu.com -www     //搜索除了www.xxx.com其他的网站信息

filetype:文件类型    //搜索指定文件类型

intitle:keyword    //搜索标题存在特定关键字的网页

intext:keyword     //搜索正文存在特定关键字的网页intext:powered by wordpress              搜索wordpress制作的博客网址intext:Powered by *CMS                        搜索CMS相关的页面

nmap -p 1-65535 <目标域名> （所有端口扫描）nmap -p 80,443,8080,8000,5000 <目标域名> （常用端口扫描）nmap -sV -p <开放端口> <目标域名> （服务器版本检测）

gobuster dir -u http://<目标域名>:<开放端口> -w /path/to/wordlist.txtdirb http://<目标域名>:<开放端口> /path/to/wordlist.txt

./scan.sh example.com#!/bin/bashTARGET=$1WORDLIST="/usr/share/wordlists/dirb/common.txt"# 检查输入if [ -z "$TARGET" ]; then    echo "Usage: $0 <target-domain>"    exit 1fi# 端口探测echo "Scanning ports for $TARGET..."nmap -p 1-65535 $TARGET -oN ports.txt# 查找开放的 HTTP/HTTPS 端口OPEN_PORTS=$(grep "/open" ports.txt | awk '{print $2}' | tr 'n' ' ')if [ -z "$OPEN_PORTS" ]; then    echo "No open ports found."    exit 1fi# 迭代每个开放的端口进行目录探测for PORT in $OPEN_PORTS; do    echo "Found open port: $PORT"        # 目录探测    echo "Directory scanning on http://$TARGET:$PORT..."    gobuster dir -u http://$TARGET:$PORT -w $WORDLISTdone

<img src="https://shs3.b.qianxin.com/butian_public/fbd5efafd73d26f81d080f48c4df128c8.png" alt="image-20240723162433165" style="zoom:150%;" />

adminautotestcertconfluenceconsolecrmgalaxygit gitlabgrafanahritjirak8skafkakafka-manageroaokrpackagepackagesreleaserepo reportssowikiworkzabbix

https://github.com/fofapro/Hosts_scan

<img src="https://shs3.b.qianxin.com/butian_public/f727ee35e285812de1e68f1a102be5c62.png" alt="image-20240723170117375" style="zoom:200%;" />

https://github.com/cckuailong/hostscanhttps://github.com/alwaystest18/hostCollision

https://www.wappalyzer.com/

whatweb www.xxx.com   //扫描单个目标whatweb -i xxx --log-brief=txt.txt   //把目标保存为txt文件，扫描多个目标

%framework_name%powered bybuilt uponrunning

httpd.conf、.htaccess   //Apachenginx.conf    //nginxweb.config、applicationHost.config   //IISapplication.properties、application.yml  //springbootserver.xml    //Tomcatphp.ini       //PHPsettings.py、wsgi.py   //Python、Djangopostgresql.conf  //PostgreSQLmy.cnf、my.ini   //Mysqlmongod.conf      //MongoDBredis.conf       //Rediselasticsearch.yml  //elasticsearch

X-Powered-By: PHP/7.4.3

Cookie: CAKEPHP=xxxxxxxxxxxx;    //web应用框架是CakePHP

https://github.com/Tuhinshubhra/CMSeeK

https://github.com/F6JO/CmsVulScan

https://github.com/search/advanced

"token""password""secret""passwd""username""key""apidocs""AWSSecretKey""access_key""access_token""amazonaws""apiSecret""api_key""api_secret""auth""aws_access""config""login""mysql""pass""pwd""ssh""swagger""jdbc"

https://www.lingfengyun.com/

http://www.zhuzhupan2.com/

http://finger.tidedesec.net/

http://github.com/TideSec/TideFinger

https://github.com/owasp-amass/amass

项目地址：https://github.com/TideSec/TscanPlus

https://github.com/lemonlove7/EHole_magic