https://www.clearsec.org/wikis/ise/pentest/Recent content in 🧽Pen Test on ClearSec WikiHugozh-cnhttps://www.clearsec.org/wikis/ise/pentest/0_%E4%BF%A1%E6%81%AF%E6%94%B6%E9%9B%86/Sun, 17 Nov 2024 09:44:26 +0800https://www.clearsec.org/wikis/ise/pentest/0_%E4%BF%A1%E6%81%AF%E6%94%B6%E9%9B%86/<h1 id="1-google-hacking">1. Google Hacking</h1> <p>Google Hacking Database(GHDB)：<a href="https://www.exploit-db.com/google-hacking-database">https://www.exploit-db.com/google-hacking-database</a><br> 谷歌搜索语法介绍：<a href="https://program-think.blogspot.com/2013/03/internet-resource-discovery-2.html">https://program-think.blogspot.com/2013/03/internet-resource-discovery-2.html</a></p> <p>常见案例：</p> <table> <thead> <tr> <th>搜索语法</th> <th>作用</th> </tr> </thead> <tbody> <tr> <td><a href="https://www.google.com/search?q=site:edu.cn&#43;filetype:xls&#43;%22%E8%BA%AB%E4%BB%BD%E8%AF%81%22">site:edu.cn filetype:xls “身份证”</a></td> <td>查找教育机构的带有“身份证”字段的excel表格</td> </tr> <tr> <td><a href="https://www.google.com/search?q=inurl:phpmyadmin/index.php?server=1">inurl:phpmyadmin/index.php?server=1</a></td> <td>查找phpmyadmin登录页</td> </tr> <tr> <td><a href="https://www.google.com/search?q=inurl:info.php&#43;intext:%22PHP&#43;Version%22&#43;intitle:%22phpinfo%28%29%22">inurl:info.php intext:”PHP Version” intitle:”phpinfo()</a></td> <td>查找展示phpinfo()的站点</td> </tr> <tr> <td><a href="https://www.google.com/search?q=inurl:%22.php?id=%22&#43;%22You&#43;have&#43;an&#43;error&#43;in&#43;your&#43;SQL&#43;syntax%22">inurl:”.php?id=” “You have an error in your SQL syntax”</a></td> <td>查找可能存在SQL注入的站点</td> </tr> <tr> <td><a href="https://www.google.com/search?q=intitle:%22%E5%90%8E%E5%8F%B0%E7%99%BB%E9%99%86%22&#43;inurl:http:">intitle:后台登陆 inurl:http:</a></td> <td>查找登录页为http的站点</td> </tr> <tr> <td><a href="https://www.google.com/search?q=intitle:%22index&#43;of%22&#43;intext:%22Last&#43;modified%22">intitle:”index of” intext:”Last modified”</a></td> <td>查找存在目录遍历的站点</td> </tr> </tbody> </table> <blockquote> <p>注意：频繁进行Google Hacking会被谷歌识别为异常流量而进行人机验证</p> </blockquote> <h2 id="2-网络空间资产测绘平台">2. 网络空间资产测绘平台</h2> <h2 id="21-shodanˈʃoʊdæn">2.1 Shodan(/ˈʃoʊ.dæn/)</h2> <p>官网(需登录使用)：<a href="https://www.shodan.io/">https://www.shodan.io/</a><br> 浏览器扩展：<a href="https://chromewebstore.google.com/detail/shodan/jjalcfnidlmpjhdfepjhjbhnhkbgleap">https://chromewebstore.google.com/detail/shodan/jjalcfnidlmpjhdfepjhjbhnhkbgleap</a><br> <a href="https://help.shodan.io/command-line-interface/0-installation">CLI使用</a>：<code>python -m pip install shodan -i https://pypi.tuna.tsinghua.edu.cn/simple</code></p> <p>[<img src="https://www.clearsec.org/wikis/_resources/%C2%A70_%E4%BF%A1%E6%81%AF%E6%94%B6%E9%9B%86/465a87b209d26fec31b78c0d0aa7b010_MD5.png" alt="alt text">]</p> <p>常见案例：</p> <table> <thead> <tr> <th><a href="https://www.shodan.io/search/examples">搜索语法</a></th> <th>作用</th> </tr> </thead> <tbody> <tr> <td><a href="https://www.shodan.io/search?query=Hikvision-Webs&#43;country:cn&#43;city:changsha">Hikvision-Webs country:cn city:changsha</a></td> <td>搜索长沙的海康威视摄像头后台页</td> </tr> <tr> <td><a href="https://www.shodan.io/search?query=port:3389&#43;country:cn&#43;city:beijing">port:3389 country:cn city:beijing</a></td> <td>搜索北京的开启了RDP的服务器</td> </tr> <tr> <td><a href="https://www.shodan.io/search?query=vuln:CVE-2017-0144&#43;country:cn">vuln:CVE-2017-0144 country:cn</a></td> <td>搜索存在永恒之蓝漏洞的中国设备(漏洞搜索需要付费)</td> </tr> <tr> <td><a href="https://www.shodan.io/search?query=country:cn&#43;city:changsha&#43;nginx">country:cn city:changsha nginx</a></td> <td>搜索长沙的Nginx服务器</td> </tr> <tr> <td><a href="https://www.shodan.io/search?query=isp:huawei&#43;country:cn">isp:huawei country:cn</a></td> <td>搜索华为的基础设施设备</td> </tr> </tbody> </table> <h2 id="22-fofa">2.2 FOFA</h2> <p>官网：<a href="https://fofa.info/">https://fofa.info/</a><br> 浏览器扩展(非官方)：<a href="https://chromewebstore.google.com/detail/fofa-pro-view/dobbfkjhgbkmmcooahlnllfopfmhcoln">https://chromewebstore.google.com/detail/fofa-pro-view/dobbfkjhgbkmmcooahlnllfopfmhcoln</a></p>