9.3. 信息收集

9.3.1. 子域爆破

• subDomainsBrute

• wydomain

• broDomain

• ESD

• aiodnsbrute

• OneForAll

• subfinder

9.3.2. 域名获取

• the art of subdomain enumeration

• sslScrape

• aquatone A Tool for Domain Flyovers

9.3.3. 弱密码爆破

• hydra

• medusa

• htpwdScan

• patator

9.3.4. Git信息泄漏

• GitHack By lijiejie

• GitHack By BugScan

• GitTools

• Zen

• dig github history

• gitrob Reconnaissance tool for GitHub organizations

• git secrets

• shhgit Find GitHub secrets in real time

• GitHound GitHound pinpoints exposed API keys on GitHub using pattern matching, commit history searching, and a unique result scoring system. A batch-catching, pattern-matching, patch-attacking secret snatcher.

9.3.5. Github监控

• Github Monitor

• Github Dorks

• GSIL

• Hawkeye

• gshark

• GitGot

• gitGraber

9.3.6. 路径及文件扫描

• weakfilescan

• DirBrute

• dirsearch

• bfac

• ds_store_exp

9.3.7. 路径爬虫

• crawlergo A powerful dynamic crawler for web vulnerability scanners

9.3.8. 指纹识别

• Wappalyzer

• whatweb

• Wordpress Finger Print

• CMS指纹识别

• JA3 is a standard for creating SSL client fingerprints in an easy to produce and shareable way

9.3.9. Waf指纹

• identywaf

• wafw00f

• WhatWaf

9.3.10. 端口扫描

• nmap

• zmap

• masscan

• ShodanHat

• DNS dnsenum nslookup dig fierce

• SNMP snmpwalk

9.3.11. DNS数据查询

• VirusTotal

• PassiveTotal

• DNSDB

• sitedossier

9.3.12. DNS关联

• Cloudflare Enumeration Tool

• amass

• Certificate Search

9.3.13. 云服务

• Find aws s3 buckets

• CloudScraper

• AWS Bucket Dump

9.3.14. 数据查询

• Censys

• Shodan

• Zoomeye

• fofa

• scans

• Just Metadata

• publicwww - Find Web Pages via Snippet

9.3.15. Password

• Probable Wordlists Wordlists sorted by probability originally created for password generation and testing

• Common User Passwords Profiler

• chrome password grabber

9.3.16. 字典

• Blasting dictionary

• pydictor

9.3.17. CI信息泄露

• secretz minimizing the large attack surface of Travis CI

9.3.18. 其他

• datasploit

• watchdog

• archive

• HTTPLeaks

• htrace

• AWSBucketDump