谷歌hack

0x00

网上搜集整理的一些可能会用到的Googlehack语法

0x01

intitle: 从网页标题中搜索指定的关键字,可专门用来搜索指定版本名称的各类 web 程序,也可用 allintitle
inurl: 从 url 中搜索指定的关键字,可专门用来构造各种形式的漏洞 url,也可用 allinurl
intext: 从网页中搜索指定的关键字,经常会用它来穿透到漏洞页面……也可用 allintext
filetype: 搜索指定的文件后缀,例如:sql mdb txt bak backup ini zip rar doc xls……
site: 在某个特定的网站内中搜索指定的内容
link: 搜索和该链接有关联的链接,比如:友情链接
index of: 找目录遍历时也许会用到
tomcat：
intext:$CATALINA_HOME/webapps/ROOT/ intitle:apache tomcat 直接这样搜结果肯定会非常多
intext:$CATALINA_HOME/webapps/ROOT/ inurl:8080/ 我们可以带指定端口号去搜,因为有些 web 并非在默认端口上,这样搜的话,可以尽量防止有漏网之鱼
intext:$CATALINA_HOME/webapps/ROOT/ intitle:Apache Tomcat/5.5.27 site:*.hk 针对特定版本特定国家去搜,比如爆出某个版本有远程执行类的漏洞就可以利用这种方式来批量进行
intext:$CATALINA_HOME/webapps/ROOT/ intitle:Apache Tomcat/7.0.32 site:*.gov.br
intext:$CATALINA_HOME/webapps/ROOT/ intitle:Apache Tomcat/5.0.12 site:*.cn
intext:$CATALINA_HOME/webapps/ROOT/ intitle:Apache Tomcat/6.0.24 site:*.com
intext:$CATALINA_HOME/webapps/ROOT/ intitle:apache tomcat site:*.edu.*
intext:$CATALINA_HOME/webapps/ROOT/ intitle:apache tomcat site:*.gov.* 搜特定类型的目标站点,如,学校一般都是 edu,各种民间组织一般都是 org,政府机构一般都是 gov……
intext:$CATALINA_HOME/webapps/ROOT/ intitle:apache tomcat site:*.org.*
intext:$CATALINA_HOME/webapps/ROOT/ intitle:Apache Tomcat/7.0 site:*.org.*
intext:$CATALINA_HOME/webapps/ROOT/ intitle:apache tomcat site:*.jp
intext:$CATALINA_HOME/webapps/ROOT/ intitle:apache tomcat site:*.vn
intext:$CATALINA_HOME/webapps/ROOT/ intitle:apache tomcat site:*.ph
intext:$CATALINA_HOME/webapps/ROOT/ intitle:Apache Tomcat site:*.uk
intext:$CATALINA_HOME/webapps/ROOT/ intitle:apache tomcat site:baidu.com 无意发现百度的某个子域,竟然是个博彩站
intext:$CATALINA_HOME/webapps/ROOT/ intitle:apache tomcat site:org.tw

weblogic：
inurl:/console/login/LoginForm.jsp 这样范围太大,可根据上面的示例随意变形
inurl:/console/login/LoginForm.jsp intitle:Oracle WebLogic Server
inurl:/console/login/ intitle:"Oracle WebLogic Server 管理控制台"
jboss：
inurl:/jmx-console/htmladaptor
inurl:/jmx-console/htmladaptor site:*.edu.*
inurl:/jmx-console/htmladaptor site:*.org.*
inurl:/jmx-console/htmladaptor site:*.tw
websphere：
inurl:/ibm/console/logon.jsp
phpmyadmin：
inurl:/phpMyAdmin/index.php
inurl:/phpMyAdmin/index.php db+information_schema 指定命中数据
inurl:/phpMyAdmin/index.php intext:phpMyAdmin 2.7.0 直接针对特定版本号去搜索,更加精准
inurl:/phpMyAdmin/index.php site:*.tw
inurl:/phpMyAdmin/index.php site:*.org
inurl:/phpMyAdmin/index.php site:*.hk
webmin 入口[其实就是一个 web 版的 linux 系统管理工具,默认情况下工作在 web 端的 10000 端口上]:
intitle:Login to Webmin intext:"login to the Webmin server on"
wordpress：
inurl:/wp-login.php site:*.hk
index of /wp-content/uploads inurl:/wp-login.php
inurl:/wp-content/themes/theagency 上传漏洞
joomla：
inurl:/administrator/index.php
inurl:index.php?option=com_advertisementboard 找注入
inurl:index.php?option=com_carocci
inurl:index.php?option=com_product
inurl:/administrator/index.php site:*.hk
drupal：
inurl:CHANGELOG.txt intext:drupal intext:"SA-CORE" -site:github.com -site:drupal.org
开源知名 cms：
power by wordpress
powered by discuz x3.2
powered by phpcms 2008
powered by drupal 7
powered by dedecmsv57_gbk
powered by CubeCart 3.0.6
Powered by phpBB 2.0.6
powered by paBugs 2.0 Beta 3
inurl:wp-login.php
inurl:/administrator/index.php
inurl:/admina.php
owa：
inurl:/owa/auth/logon.aspx
inurl:/owa/auth/logon.aspx site:*.org.*
mirapoint(ShellShock)：
inurl:/cgi-bin/search.cgi site:*.org.*
inurl:/cgi-bin/madmin.cgi
Zimbra(本地包含):
inurl:7071/zimbraAdmin/
inurl:/help/en_US/standard/version.htm
通用后台：
inurl:/manager/login.php site:*.jp
inurl:/cms/login.php site:*.jp
inurl:/manage/index.php site:*.jp
inurl:/system/login.php site:*.jp
inurl:/webadmin/login.php site:*.tw
inurl:admin_login.php intitle:admin login
inurl:admin_login.php intitle:admin page
inurl:/admin/login.php site:*.tw
inurl:/admin/index.php site:*.tw
inurl:/system/adminlogin.asp site:*.tw
inurl:/manage/login.aspx site:*.tw
inurl:/sysadm/index.php site:*.com
SVN：
inurl:/.svn/entries
inurl:/.svn/entries site:*.org.*
inurl:/.svn/entries site:*.gov.br
inurl:/.svn/entries site:*.hk
后台未授权：
intext:"Website Design & Developed By : WebSay" 默认后台/admin
intext:"Powered by ENS Consultants" 默认后台/admin/login.php
intext:"Desenvolvimento - MW Way" 默认后台/admin/index.php
inurl:.php?id= intext:"Web realizada por Soma Estudio"
inurl:/_mycps/login.php
编辑器：
intext:" Powered by JADBM " JADBM Cms upload shell 注册后登陆上传即可
inurl:"/index.php/frontend/login/en" Estate cms upload shell 注册后登陆上传即可
inurl:/Content/Roxy_Fileman/ 该路径下直接就是上传点
index of:"filemanager/dialog.php" 该脚本就是上传脚本直接上传即可
intext:"Desenvolvido por Webnet Soluções Tecnológicas." fck 上传
inurl:"subir_foto.php" 上传点
inrul:"/imce?dir=" intitle:"File Browser"
inurl:"Powered by Vision Helpdesk 3.9.10 Stable" 注册后登陆进去编辑个人配置上传
index of /admin/fckeditor site:*.tw
inurl:/ewebeditor/ site:*.tw
inurl:/admin/upload_file.php
inurl:/admin/upfile.php
inurl:/admin/upload.asp
命令执行：
inurl:footer.inc.php?settings=
inurl:/pb_inc/admincenter/index.php?page=
inurl:/pnadmin/categories.inc.php?subpage=
inurl:/index.php??view=src/sistema/vistas/
inurl:/edit.php?em=file&filename=
inurl:/path_to_athena/athena.php?athena_dir= 远程包含
inurl:/path_to_qnews/q-news.php?id= 远程包含
inurl:/inc/backend_settings.php?cmd=
inurl:login.action strus2 系列执行漏洞利用
各种参数：
inurl:php?x= inurl:php?open=
inurl:php?visualizar= inurl:php?pagina=
inurl:php?inc= inurl:php?include_file=
inurl:php?page= inurl:php?pg=
inurl:php?show= inurl:php?cat=
inurl:php?file= inurl:php?path_local=
inurl:php?filnavn= inurl:php?HCL_path=
inurl:php?doc= inurl:php?appdir=
inurl:php?phpbb_root_dir= inurl:php?phpc_root_path=
inurl:php?path_pre= inurl:php?nic=
inurl:php?sec= inurl:php?content=
inurl:php?link= inurl:php?filename=
inurl:php?dir= inurl:php?document=
inurl:index.php?view= inurl:*.php?locate=
inurl:*.php?place= inurl:*.php?layout=
inurl:*.php?go= inurl:*.php?catch=
inurl:*.php?mode= inurl:*.php?name=
inurl:*.php?loc= inurl:*.php?f=
inurl:*.php?inf= inurl:*.php?pg=
inurl:*.php?load= inurl:*.php?naam=
allinurl:php?page= allinurl:php?file=
inurl:php?x= inurl:admin.php?cal_dir=
inurl:php?include= inurl:php?nav=
inurl:*.php?sel= inurl:php?p=
inurl:php?conf= inurl:php?prefix=
inurl:theme.php?THEME_DIR=
inurl:php?lvc_include_dir=
inurl:php?basepath= inurl:php?pm_path=
inurl:php?user_inc= inurl:php?cutepath=
inurl:php?fil_config= inurl:php?libpach=
inurl:php?pivot_path= inurl:php?rep=
inurl:php?conteudo= inurl:php?root=
inurl:php?configFile inurl:php?pageurl
inurl:php?inter_url inurl:php?url=
inurl:php?cmd= inurl:path.php?my=
inurl:php?xlink= inurl:php?to=
inurl:file.php?disp=
inurl:article.php?ID= inurl:newsDetail.php?id=
inurl:show.php?id= inurl:newsone.php?id=
inurl:news.php?id= inurl:event.php?id=
inurl:preview.php?id= inurl:pages.php?id=
inurl:main.php?id= inurl:prod_detail.php?id=
inurl:view.php?id= inurl:product.php?id=
inurl:contact.php?Id= inurl:display_item.php?id=
inurl:item.php?id= inurl:view_items.php?id=
inurl:details.asp?id= inurl:profile.asp?id=
inurl:content.asp?id= inurl:display_item.asp?id=
inurl:view_detail.asp?ID= inurl:section.php?id=
inurl:theme.php?id= inurl:produit.php?id=
inurl:chappies.php?id= inurl:readnews.php?id=
inurl:rub.php?idr= inurl:pop.php?id=
inurl:person.php?id= inurl:read.php?id=
inurl:reagir.php?num= inurl:staff_id=
inurl:gallery.php?id= inurl:humor.php?id=
inurl:spr.php?id= inurl:gery.php?id=
inurl:profile_view.php?id=
inurl:fellows.php?id= inurl:ray.php?id=
inurl:productinfo.php?id=
inurl:file.php?cont= inurl:include.php?chapter=
inurl:principal.php?param=
inurl:general.php?menue= inurl:php?pref=
inurl:nota.php?chapter= inurl:php?str=
inurl:php?corpo= inurl:press.php?*[*]*=
商城类注入：
inurl:".php?catid=" intext:"View cart" inurl:".php?catid=" intext:"Buy
Now" inurl:".php?catid=" intext:"add to cart" inurl:".php?catid="
intext:"shopping" inurl:".php?catid=" intext:"boutique"
inurl:".php?catid=" intext:"/store/" inurl:".php?catid=" intext:"/shop/"
inurl:".php?catid=" intext:"Toys" inurl:details.php?BookID=
inurl:shop.php?do=part&id=
数据库报错,物理路径,数据库版本,服务器探针类文件：
site:*.tw inurl:/phpinfo.php
filetype:log "PHP Parse error"| "PHP Warning"
site:*.tw "id=" & intext:"Warning: mysql_fetch_array()
site:*.jp "id=" & intext:"Warning: getimagesize()
site:*.br "id=" & intext:"Warning: array_merge()
site:*.tw "id=" & intext:"Warning: mysql_fetch_assoc()
site:*.tw "id=" & intext:"Warning: mysql_result()
site:*.jp "id=" & intext:"Warning: pg_exec()
site:*.tw "id=" & intext:"Warning: require()
inurl:/robots.txt site:*.*
filetype:sql inurl:backup inurl:wp-content
inurl:/eWebEditor/db/ site:*.com
各种账号密码,比如,数据库密码,ftp,vpn,htpasswd,telnet 等等：
inurl:passlist.txt
inurl:password.txt
filetype:htpasswd
filetype:pcf "GroupPwd" cisco VPN
cisco 在线密码解密网站:
https://www.unix-ag.uni-kl.de/~massar/bin/cisco-decode
ftp 账号密码：
"index of/" "ws_ftp.ini" "parent directory"
"your password is" filetype:log
filetype:ini inurl:"serv-u.ini"
filetype:ini inurl:flashFXP.ini
filetype:ini ServUDaemon
filetype:ini wcx_ftp
filetype:ini ws_ftp pwd
ext:inc "pwd=" "UID="
auth_user_file.txt
admin account info" filetype:log
目录遍历：
site:*.hk index of /admin
site:*.hk index of /upfiles
site:*.hk index of /fckeditor/editor/
site:*.tw index of /admin/uploadfile
site:*.tw index of /admin/file
site:*.tw index of /system/file
site:*.tw index of /phpmyadmin
site:*.tw index of /web/backup/
inurl:/phpmyadmin/index.php site:*.tw
他人 webshell：
inurl:b374k.php filetype:php
inurl:c99.php
inurl:c100.php Generation time:
inurl:itsecteam_shell.php
intext:x2300 Locus7Shell v. 1.0a beta Modded by
intext:c99shell inurl:c99.php
powered by Captain Crunch Security Team
"inurl:c99.php" + "intext:safe"
intitle:r57shell
intitle:c99shell +uname
inurl:c99.php uid=0(root)
intitle:c99shell+filetype:php
intitle:ly0kha shell
inurl:.php "cURL: ON MySQL: ON MSSQL: OFF"
"Shell" filetypehp intext:"uname -a:" "EDT 2010"
intitle:"intitle:r57shell"
inurl:"c99.php" & intext:Encoder Tools Proc.
inurl:"c100.php" & intext:Encoder Tools Proc.
intitle:"Shell" inurl:".php" & intext:Encoder Tools Proc.