信息收集大全：被动侦察 + 主动扫描 + JS 敏感信息挖掘

前言

情报收集（Reconnaissance）决定了 80% 的渗透效率。好的渗透测试工程师把 50% 以上的时间花在这一步。

一、被动侦察（不触碰目标）

1.1 WHOIS + DNS

whois example.com | grep -iE "org|registrar|phone|email|name server"
dig example.com ANY +noall +answer
dig example.com MX +short
dig example.com TXT +short    # SPF/DKIM
dig example.com AXFR @ns1.example.com  # 偷 DNS 全量（试试运气）
delv example.com              # DNSSEC 检查

1.2 SSL 证书透明度（crt.sh 最强）

# 拉所有用过该域名证书的子域名
curl -s "https://crt.sh/?q=%.example.com&output=json" | \
  jq -r '.[].name_value' | sort -u | sed 's/^*\.//' > crt_subs.txt
wc -l crt_subs.txt

# 查看证书 SAN 信息
openssl s_client -connect example.com:443 2>/dev/null | \
  openssl x509 -noout -text | grep -A1 "Subject Alternative"

1.3 互联网搜索引擎

# Shodan
curl "https://api.shodan.io/shodan/host/search?query=example.com&key=$SHODAN_KEY" | jq '.matches | length'
# 找暴露的 Redis
curl "https://api.shodan.io/shodan/host/search?query=product:Redis+example.com&key=$SHODAN_KEY"

# Censys
curl -H "Authorization: Bearer $CENSYS_ID:$CENSYS_SECRET" \
  "https://search.censys.io/api/v2/search/hosts?q=example.com" | jq '.result.hits | length'

# FOFA（国内最强）
curl -g "https://fofa.info/api/v1/search/all?email=$FOFA_EMAIL&key=$FOFA_KEY&qbase64=$(echo -n 'domain="example.com"' | base64)&size=1000" | jq '.'
# 找特定组件: app="Apache-Shiro" && domain="example.com"

1.4 GitHub / GitLab 代码泄露

# GitHub Dork 高级搜索
# site:github.com "example.com" password
# site:github.com "example.com" api_key
# site:github.com "BEGIN RSA PRIVATE KEY" example.com
# "aws_access_key_id" example.com extension:yml

# GitDorker（自动 dork）
python3 GitDorker.py -q example.com -dorks ~/Dorks/ -o dork_results.txt

# truffleHog
trufflehog git https://github.com/example/repo --json --regex
trufflehog github --org=example-org --json | tee secrets.json

# Gitleaks
gitleaks detect --source ./repos --report-path report.json

1.5 Wayback Machine

# 批量拉历史 URL
curl -s "https://web.archive.org/cdx/search/cdx?url=*.example.com/*&output=text&fl=original&collapse=urlkey" | sort -u > wb.txt

# 从历史 URL 找敏感文件
grep -iE '\.(bak|swp|old|orig|sql|zip|tar|gz|env|config|ini)$' wb.txt
# 找 API
grep -iE '/api/|/v1/|/v2/|/graphql' wb.txt
# 历史 .env 文件可能还能下载
curl -s "https://web.archive.org/web/20220101/http://example.com/.env"

二、主动侦察

2.1 子域名枚举

# 最快方案
subfinder -d example.com -silent -o subs.txt
subfinder -d example.com -silent -recursive -depth 3 -o subs_deep.txt

# 最全面
amass enum -d example.com -o subs_amass.txt
amass enum -active -d example.com -brute -w ~/wordlists/subdomains.txt

# 字典爆破
ffuf -u "https://FUZZ.example.com" -w ~/wordlists/subdomains-top10000.txt \
     -mc 200,301,302,403,500 -t 100 -o subs_ffuf.txt

# 合并去重
cat subs.txt subs_amass.txt subs_ffuf.txt crt_subs.txt | sort -u > all_subs.txt
wc -l all_subs.txt

2.2 端口扫描

# Masscan 全端口
masscan example.com -p1-65535 --rate=10000 -oL masscan.txt

# 高危端口快速扫
masscan example.com -p21,22,23,25,53,80,110,135,139,143,443,445,1433,1521,3306,3389,5432,6379,7001,8080,8443,9090 --rate=50000

# Nmap 服务识别
nmap -sV -sC -O -p- --min-rate 1000 example.com -oN nmap_full.txt
nmap --script vuln example.com -oN nmap_vuln.txt

# Masscan -> Nmap 管道
grep open masscan.txt | awk '{print $4}' | cut -d: -f1 | sort -u > alive.txt
nmap -sV -sC -p- -iL alive.txt -oN nmap_batch.txt

2.3 技术栈识别

# Wappalyzer CLI
wappalyzer-cli http://example.com

# WhatWeb（最准）
whatweb -v http://example.com

# 手工识别技巧
curl -sI http://example.com
# 看 Server, X-Powered-By, X-AspNet-Version, X-Drupal-Cache

# Cookie 识别框架
# JSESSIONID -> Java
# PHPSESSID -> PHP
# ASP.NET_SessionId -> .NET
# rememberMe -> Shiro

# favicon hash（Shodan 指纹）
curl -s http://example.com/favicon.ico -o favicon.ico
python3 -c "import mmh3; print(mmh3.hash(open('favicon.ico','rb').read()))"
# 去 Shodan 搜: http.favicon.hash:123456

2.4 目录爆破

# ffuf
ffuf -u "http://example.com/FUZZ" -w ~/wordlists/directory-list-2.3-medium.txt \
     -mc 200,301,302,403,500 -t 50 -o ffuf_dir.txt

# 带扩展名
ffuf -u "http://example.com/FUZZ" -w dirs.txt -e php,asp,aspx,jsp,html,txt,bak,zip,swp

# API Fuzz
ffuf -u "http://example.com/api/v1/FUZZ" -w api-endpoints.txt -mc 200,201,204,301 -t 100

# 过滤已知 404 页面大小
ffuf -u "http://example.com/FUZZ" -w dirs.txt -fs 1234 -t 50

三、JS 文件敏感信息挖掘

# 1. 提取页面所有 JS 文件
curl -s http://example.com | grep -oP 'src="[^"]+\.js[^"]*"' | sed 's/src="//;s/"$//' | sort -u > js_files.txt

# 2. Katana 爬虫
katana -u http://example.com -js-crawl -d 3 -o crawled.txt

# 3. LinkFinder
python3 linkfinder.py -i http://example.com -o linkfinder.html

# 4. SecretFinder
python3 secretfinder.py -i https://example.com/static/js/main.js -o result.json

# 5. 手工 grep 敏感模式
grep -rn -iE "(api[_-]?key|secret|token|password|authorization|bearer|client[_-]?secret)" *.js
grep -rn "AKIA[A-Z0-9]\{16\}" *.js          # AWS Access Key
grep -rn "ghp_[A-Za-z0-9]\{36\}" *.js     # GitHub Token
grep -rn "sk_live_[A-Za-z0-9]\{16\}" *.js # Stripe
grep -rn "eyJ[A-Za-z0-9_-]{20,}\." *.js   # JWT

# 6. SourceMap 泄露
curl -s http://example.com/static/js/main.js.map | jq .
# 里面有完整源码 + 文件路径！

# 7. 提取隐藏 API 路径
grep -oP '["'"'"'`]/[a-zA-Z0-9_./?-]+["'"'"'`]' *.js | sort -u | \
  grep -vE "\.(css|png|jpg|gif|svg|woff|ttf|eot)" | \
  sed 's/^["'"'"'`]//;s/["'"'"'`]$//' > js_paths.txt

四、完整 Recon Pipeline 脚本

#!/bin/bash
# recon.sh - 完整信息收集流水线
DOMAIN=$1
OUT_DIR="./recon_$DOMAIN"
mkdir -p "$OUT_DIR" && cd "$OUT_DIR"

echo "[*] Phase 1: 被动侦察"
curl -s "https://crt.sh/?q=%.$DOMAIN&output=json" | jq -r '.[].name_value' | \
  sort -u | sed 's/^*\.//' > crt_subs.txt
subfinder -d "$DOMAIN" -silent > subfinder_subs.txt
waybackurls "$DOMAIN" > wayback_urls.txt 2>/dev/null

echo "[*] Phase 2: 子域名合并 + 去重"
cat crt_subs.txt subfinder_subs.txt wayback_urls.txt 2>/dev/null | \
  grep -E "\.$DOMAIN$" | sed 's/^*\.//' | sort -u > all_subs.txt
echo "  -> $(wc -l < all_subs.txt) 个子域名"

echo "[*] Phase 3: 存活 Web 服务探测"
cat all_subs.txt | httpx -silent -title -tech-detect -o alive_web.txt
echo "  -> $(wc -l < alive_web.txt) 个活跃 Web 服务"

echo "[*] Phase 4: 端口扫描"
cat alive_web.txt | awk '{print $1}' | sed 's|https\?://||' | \
  xargs -I{} dig +short {} @8.8.8.8 2>/dev/null | sort -u > ips.txt
masscan -iL ips.txt -p1-65535 --rate=50000 -oL masscan.txt

echo "[*] Phase 5: 批量扫描"
nuclei -l alive_web.txt -t ~/nuclei-templates/ -o nuclei_findings.txt
nmap -sV -sC -iL ips.txt -p- --min-rate 500 -oN nmap_full.txt

echo "[+] 完成！结果在 $OUT_DIR/"
ls -lh

五、工具速查表