目录子域枚举

目录子域枚举

工具使用

dirb http://{target_ip} -X .php

dirsearch -u "http://{target_ip}"

dirsearch -u http://10.0.0.20 -f -e html,php,txt -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-small.txt

feroxbuster -u http://10.129.106.205

可用模式

• dir - 经典目录暴力破解模式

• dns - DNS子域暴力破解模式

• vhost - 虚拟主机强制模式（与DNS不同！）

gobuster dir --url [http://](http://10.129.35.99/){target_ip} -w /usr/share/wordlists/dirbuster/directory-list-lowercase-2.3-small.txt -x php,html

gobuster vhost -u [http://](http://10.129.35.99/){target_ip} -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt

sudo apt install feroxbuster -y

#由于feroxbuster本身没有内建目录字典，需要调用seclists中的字典，所以这个也需要安装一下
sudo apt install seclists -y

feroxbuster --url http://10.0.0.105

子域枚举

wfuzz -c -f domain.txt -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt -u "[http://siteisup.htb/](http://siteisup.htb/)" -H "Host: FUZZ.siteisup.htb" --hl 39

路径信息

http://www.xx.xx.xx.xx/backups/ backups代表备份文件夹