9.3. 信息收集

9.3.1. 子域爆破

• subDomainsBrute
• wydomain
• broDomain
• ESD
• aiodnsbrute
• OneForAll
• subfinder

9.3.2. 域名获取

• the art of subdomain enumeration
• sslScrape
• aquatone A Tool for Domain Flyovers

9.3.3. 弱密码爆破

• hydra
• medusa
• htpwdScan
• patator

9.3.4. Git信息泄漏

• GitHack By lijiejie
• GitHack By BugScan
• GitTools
• Zen
• dig github history
• gitrob Reconnaissance tool for GitHub organizations
• git secrets

9.3.5. Github监控

• Github Monitor
• Github Dorks
• GSIL
• Hawkeye
• gshark
• GitGot
• gitGraber

9.3.6. 路径及文件扫描

• weakfilescan
• DirBrute
• dirsearch
• bfac
• ds_store_exp

9.3.7. 路径爬虫

• crawlergo A powerful dynamic crawler for web vulnerability scanners

9.3.8. 指纹识别

• Wappalyzer
• whatweb
• Wordpress Finger Print
• CMS指纹识别
• JA3 is a standard for creating SSL client fingerprints in an easy to produce and shareable way

9.3.9. Waf指纹

• identywaf
• wafw00f
• WhatWaf

9.3.10. 端口扫描

• nmap
• zmap
• masscan
• ShodanHat
• DNS dnsenum nslookup dig fierce
• SNMP snmpwalk

9.3.11. DNS数据查询

• VirusTotal
• PassiveTotal
• DNSDB
• sitedossier

9.3.12. DNS关联

• Cloudflare Enumeration Tool
• amass
• Certificate Search

9.3.13. 云服务

• Find aws s3 buckets
• CloudScraper
• AWS Bucket Dump

9.3.14. 数据查询

• Censys
• Shodan
• Zoomeye
• fofa
• scans
• Just Metadata
• publicwww - Find Web Pages via Snippet

9.3.15. Password

• Probable Wordlists
• Common User Passwords Profiler
• chrome password grabber

9.3.16. 字典

• Blasting dictionary
• pydictor

9.3.17. 其他

• datasploit
• watchdog
• archive
• HTTPLeaks
• htrace
• AWSBucketDump