# 信息收集
English: Information Gathering
- Tool Count: 20
- Use this file to choose the right tool quickly, then open the linked source markdown for full command details.
## Nmap
- ID: nmap
- Command Count: 14
- Original Extracted Source: original extracted tools-wiki source/nmap.md
Description:
网络扫描和安全审计工具
Installation:
apt install nmap / yum install nmap / brew install nmap
Representative Commands:
- TCP连接扫描: `nmap -sT target_ip`
- SYN隐蔽扫描: `nmap -sS target_ip`
- UDP扫描: `nmap -sU target_ip`
- 服务版本探测: `nmap -sV target_ip`
- 操作系统探测: `nmap -O target_ip`
External References:
- https://nmap.org/docs.html
## Gobuster
- ID: gobuster
- Command Count: 7
- Original Extracted Source: original extracted tools-wiki source/gobuster.md
Description:
目录和子域名爆破工具
Installation:
apt install gobuster
Representative Commands:
- 目录爆破: `gobuster dir -u http://target.com -w wordlist.txt`
- 指定扩展名: `gobuster dir -u http://target.com -w wordlist.txt -x php,html,txt`
- 子域名爆破: `gobuster dns -d target.com -w subdomains.txt`
- 使用Cookie: `gobuster dir -u http://target.com -w wordlist.txt -c "PHPSESSID=xxx"`
- 添加Header: `gobuster dir -u http://target.com -w wordlist.txt -H "Authorization: Bearer token"`
External References:
- https://github.com/OJ/gobuster
## Nuclei
- ID: nuclei
- Command Count: 7
- Original Extracted Source: original extracted tools-wiki source/nuclei.md
Description:
快速漏洞扫描工具
Installation:
go install -v github.com/projectdiscovery/nuclei/v2/cmd/nuclei@latest
Representative Commands:
- 基础扫描: `nuclei -u http://target.com`
- 指定模板: `nuclei -u http://target.com -t cves/`
- 严重级别: `nuclei -u http://target.com -severity critical,high`
- 批量扫描: `nuclei -l urls.txt`
- 更新模板: `nuclei -update-templates`
External References:
- https://nuclei.projectdiscovery.io/
## Seatbelt
- ID: seatbelt-tool
- Command Count: 6
- Original Extracted Source: original extracted tools-wiki source/seatbelt-tool.md
Description:
Windows安全信息收集工具
Installation:
编译或下载二进制文件
Representative Commands:
- 完整收集: `Seatbelt.exe -group=all`
- 系统信息: `Seatbelt.exe -group=system`
- 用户信息: `Seatbelt.exe -group=user`
- 安全配置: `Seatbelt.exe -group=security`
- 网络信息: `Seatbelt.exe -group=network`
External References:
- https://github.com/GhostPack/Seatbelt
## SearchSploit
- ID: searchsploit-tool
- Command Count: 6
- Original Extracted Source: original extracted tools-wiki source/searchsploit-tool.md
Description:
漏洞搜索工具
Installation:
apt install exploitdb
Representative Commands:
- 搜索漏洞: `searchsploit apache 2.4`
- 精确搜索: `searchsploit -e "Apache 2.4"`
- 排除结果: `searchsploit apache --exclude="DoS"`
- 查看漏洞: `searchsploit -x exploits/xxx.py`
- 复制漏洞: `searchsploit -m exploits/xxx.py`
External References:
- https://www.exploit-db.com/
## Amass
- ID: amass-tool
- Command Count: 5
- Original Extracted Source: original extracted tools-wiki source/amass-tool.md
Description:
子域名枚举工具
Installation:
apt install amass
Representative Commands:
- 枚举子域名: `amass enum -d target.com`
- 被动枚举: `amass enum -passive -d target.com`
- 主动枚举: `amass enum -active -d target.com`
- 暴力破解: `amass enum -brute -d target.com -w wordlist.txt`
- 保存结果: `amass enum -d target.com -o output.txt`
External References:
- https://github.com/OWASP/Amass
## Subfinder
- ID: subfinder-tool
- Command Count: 5
- Original Extracted Source: original extracted tools-wiki source/subfinder-tool.md
Description:
子域名发现工具
Installation:
go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest
Representative Commands:
- 枚举子域名: `subfinder -d target.com`
- 递归枚举: `subfinder -d target.com -recursive`
- 保存结果: `subfinder -d target.com -o output.txt`
- JSON输出: `subfinder -d target.com -json -o output.json`
- 批量处理: `subfinder -dL domains.txt`
External References:
- https://github.com/projectdiscovery/subfinder
## HTTPX
- ID: httpx-tool
- Command Count: 5
- Original Extracted Source: original extracted tools-wiki source/httpx-tool.md
Description:
HTTP探测工具
Installation:
go install -v github.com/projectdiscovery/httpx/cmd/httpx@latest
Representative Commands:
- HTTP探测: `cat urls.txt | httpx`
- 获取标题: `cat urls.txt | httpx -title -status-code`
- 截图: `cat urls.txt | httpx -screenshot`
- 指纹识别: `cat urls.txt | httpx -tech-detect`
- 保存结果: `cat urls.txt | httpx -o output.txt`
External References:
- https://github.com/projectdiscovery/httpx
## Masscan
- ID: masscan
- Command Count: 5
- Original Extracted Source: original extracted tools-wiki source/masscan.md
Description:
最快的互联网端口扫描器，可在5分钟内扫描整个互联网
Installation:
apt install masscan / brew install masscan / 源码编译: git clone https://github.com/robertdavidgraham/masscan && cd masscan && make
Representative Commands:
- 快速全端口扫描: `masscan -p1-65535 target_ip --rate=1000`
- 常用端口扫描: `masscan -p80,443,8080,8443,3306,6379,27017 target_ip/24 --rate=500`
- 输出结果: `masscan -p1-65535 target_ip --rate=1000 -oJ result.json
masscan -p1-65535 target_ip --rate=1000 -oX result.xml
masscan -p1-65535 target_ip --rate=1000 -oG result.grep`
- 指定网卡和排除: `masscan -p1-65535 10.0.0.0/8 --rate=10000 -e eth0 --excludefile exclude.txt`
- 扫描Banner: `masscan -p80,443 target_ip/24 --banners --rate=500`
External References:
- https://github.com/robertdavidgraham/masscan
## Dirsearch
- ID: dirsearch
- Command Count: 5
- Original Extracted Source: original extracted tools-wiki source/dirsearch.md
Description:
高级Web目录和文件暴力破解工具
Installation:
pip3 install dirsearch / git clone https://github.com/maurosoria/dirsearch
Representative Commands:
- 基础目录扫描: `dirsearch -u https://target.com -e php,asp,aspx,jsp,html,js`
- 使用自定义字典: `dirsearch -u https://target.com -w /usr/share/wordlists/dirb/big.txt --delay=0.5`
- 递归扫描: `dirsearch -u https://target.com -e php -r -R 3 --exclude-status=403,404`
- 多线程+Cookie: `dirsearch -u https://target.com -t 20 --cookie="session=abc123" -H "Authorization: Bearer token"`
- 输出结果: `dirsearch -u https://target.com -o result.json --format=json`
External References:
- https://github.com/maurosoria/dirsearch
## FeroxBuster
- ID: feroxbuster
- Command Count: 4
- Original Extracted Source: original extracted tools-wiki source/feroxbuster.md
Description:
用Rust编写的高性能递归目录发现工具
Installation:
apt install feroxbuster / cargo install feroxbuster / 下载二进制: https://github.com/epi052/feroxbuster/releases
Representative Commands:
- 基础扫描: `feroxbuster -u https://target.com -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt`
- 递归+过滤: `feroxbuster -u https://target.com -d 3 -C 403,404,500 -x php,asp,html --rate-limit 50`
- 带认证扫描: `feroxbuster -u https://target.com -H "Cookie: session=abc" -H "Authorization: Bearer xxx" -t 30`
- 自动校准: `feroxbuster -u https://target.com --auto-tune --smart`
External References:
- https://github.com/epi052/feroxbuster
## MassDNS
- ID: massdns
- Command Count: 3
- Original Extracted Source: original extracted tools-wiki source/massdns.md
Description:
高性能DNS解析器，用于子域名暴力枚举
Installation:
git clone https://github.com/blechschmidt/massdns && cd massdns && make
Representative Commands:
- 子域名枚举: `massdns -r resolvers.txt -t A -o S -w results.txt subdomains.txt`
- 生成子域名字典: `cat subdomains.txt | sed "s/$/.target.com/" > full_subs.txt
massdns -r resolvers.txt -t A -o J full_subs.txt > results.json`
- 高并发解析: `massdns -r resolvers.txt -t A -o S -w output.txt --hashmap-size 10000 -s 10000 subs.txt`
External References:
- https://github.com/blechschmidt/massdns
## Amass
- ID: amass
- Command Count: 4
- Original Extracted Source: original extracted tools-wiki source/amass.md
Description:
OWASP出品的深度攻击面映射和资产发现工具
Installation:
apt install amass / go install github.com/owasp-amass/amass/v4/...@master / snap install amass
Representative Commands:
- 被动枚举: `amass enum -passive -d target.com -o results.txt`
- 主动枚举: `amass enum -active -d target.com -brute -w /usr/share/amass/wordlists/subdomains-top1mil.txt`
- 情报收集: `amass intel -d target.com -whois
amass intel -org "Target Corp" -max-dns-queries 2500`
- 可视化: `amass viz -d3 -d target.com
amass db -show -d target.com`
External References:
- https://github.com/owasp-amass/amass
## Subfinder
- ID: subfinder
- Command Count: 4
- Original Extracted Source: original extracted tools-wiki source/subfinder.md
Description:
被动子域名发现工具，支持多种在线数据源
Installation:
go install github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest
Representative Commands:
- 基础枚举: `subfinder -d target.com -o subs.txt`
- 递归枚举: `subfinder -d target.com -recursive -all -o subs.txt`
- 管道联动: `subfinder -d target.com -silent | httpx -silent -status-code -title`
- 多域名批量: `subfinder -dL domains.txt -o all_subs.txt -t 30`
External References:
- https://github.com/projectdiscovery/subfinder
## HTTPX
- ID: httpx
- Command Count: 4
- Original Extracted Source: original extracted tools-wiki source/httpx.md
Description:
快速多功能HTTP探针工具，用于批量探测Web服务
Installation:
go install github.com/projectdiscovery/httpx/cmd/httpx@latest
Representative Commands:
- 存活探测: `httpx -l urls.txt -status-code -title -tech-detect -o alive.txt`
- 截图+指纹: `httpx -l urls.txt -screenshot -favicon -hash md5 -jarm`
- 管道使用: `cat subs.txt | httpx -silent -mc 200,301,302 -content-length -web-server`
- 自定义探测: `httpx -l urls.txt -path "/api/v1/health,/admin,/.env,/robots.txt" -mc 200`
External References:
- https://github.com/projectdiscovery/httpx
## WhatWeb
- ID: whatweb
- Command Count: 4
- Original Extracted Source: original extracted tools-wiki source/whatweb.md
Description:
Web指纹识别工具，识别网站使用的技术栈
Installation:
apt install whatweb / gem install whatweb
Representative Commands:
- 基础指纹: `whatweb https://target.com`
- 详细模式: `whatweb -v https://target.com -a 3`
- 批量扫描: `whatweb --input-file=urls.txt --log-json=results.json`
- 指定插件: `whatweb --info-plugins
whatweb -p WordPress,Joomla,Drupal https://target.com`
External References:
- https://github.com/urbanadventurer/WhatWeb
## WAFW00F
- ID: wafw00f
- Command Count: 4
- Original Extracted Source: original extracted tools-wiki source/wafw00f.md
Description:
Web应用防火墙(WAF)检测和指纹识别工具
Installation:
pip3 install wafw00f
Representative Commands:
- WAF检测: `wafw00f https://target.com`
- 详细检测: `wafw00f https://target.com -v -a`
- 批量检测: `wafw00f -i urls.txt -o results.csv`
- 列出支持WAF: `wafw00f -l`
External References:
- https://github.com/EnableSecurity/wafw00f
## DNSRecon
- ID: dnsrecon
- Command Count: 4
- Original Extracted Source: original extracted tools-wiki source/dnsrecon.md
Description:
DNS枚举和信息收集工具
Installation:
apt install dnsrecon / pip3 install dnsrecon
Representative Commands:
- 标准枚举: `dnsrecon -d target.com -t std`
- 区域传送: `dnsrecon -d target.com -t axfr`
- 暴力枚举: `dnsrecon -d target.com -t brt -D /usr/share/wordlists/subdomains.txt`
- 反向解析: `dnsrecon -r 192.168.1.0/24 -t rvl`
External References:
- https://github.com/darkoperator/dnsrecon
## DNSEnum
- ID: dnsenum
- Command Count: 3
- Original Extracted Source: original extracted tools-wiki source/dnsenum.md
Description:
DNS信息收集工具，支持区域传送和子域名枚举
Installation:
apt install dnsenum
Representative Commands:
- 基础枚举: `dnsenum target.com`
- 子域名暴力: `dnsenum --enum -f /usr/share/dnsenum/dns.txt --threads 10 target.com`
- 指定DNS服务器: `dnsenum --dnsserver 8.8.8.8 target.com`
External References:
- https://github.com/fwaeytens/dnsenum
## theHarvester
- ID: theharvester
- Command Count: 3
- Original Extracted Source: original extracted tools-wiki source/theharvester.md
Description:
邮箱、子域名、IP等OSINT信息收集工具
Installation:
apt install theharvester / pip3 install theHarvester
Representative Commands:
- 全源搜集: `theHarvester -d target.com -b all -l 500`
- 指定数据源: `theHarvester -d target.com -b google,bing,linkedin,shodan`
- 输出报告: `theHarvester -d target.com -b all -f report.html`
External References:
- https://github.com/laramies/theHarvester

