[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-seo-572764-105":3,"detail-sidebar-cat-1-en-105":80,"doc-detail-572764-en":126},{"code":4,"msg":5,"data":6},0,"ok",{"site_id":7,"language":8,"slug":9,"title":10,"keywords":11,"description":12,"schema_data":13,"social_meta":73,"head_meta":75,"extra_data":77,"updated_unix":79},105,"en","web-attack-cheat-sheet-information-gathering","Web Attack Cheat Sheet - Information Gathering","","Web Attack Cheat Sheet 汇总了面向渗透测试与安全评估的常用流程与技术点，覆盖发现环节、目标识别、IP/子域名枚举、缓存与爬取思路、字典与目录/参数爆破，以及 DNS 与 HTTP 相关检测。内容还涉及内容安全策略（CSP）、Google Dorks、GraphQL、CORS 配置问题、监控与漏洞线索（如 CVE），并进一步列出攻击阶段的暴力破解、数据外传与多种典型漏洞利用思路。",{"@graph":14,"@context":72},[15,34,55],{"@type":16,"itemListElement":17},"BreadcrumbList",[18,23,27,31],{"item":19,"name":20,"@type":21,"position":22},"https://docshare.wps.com","Home","ListItem",1,{"item":24,"name":25,"@type":21,"position":26},"https://docshare.wps.com/template/","Template",2,{"item":28,"name":29,"@type":21,"position":30},"https://docshare.wps.com/template/general/","General",3,{"item":32,"name":10,"@type":21,"position":33},"https://docshare.wps.com/template/web-attack-cheat-sheet-information-gathering/572764/",4,{"url":32,"name":10,"@type":35,"image":36,"author":41,"headline":10,"publisher":44,"fileFormat":47,"inLanguage":8,"description":12,"dateModified":48,"datePublished":49,"encodingFormat":47,"isAccessibleForFree":50,"interactionStatistic":51},"DigitalDocument",{"url":37,"@type":38,"width":39,"height":40},"https://docshare.wps.com/thumbnails/web-attack-cheat-sheet-information-gathering/572764.png","ImageObject",442,249,{"name":42,"@type":43},"Elsa","Person",{"url":19,"name":45,"@type":46},"DocShare","Organization","application/pdf","2026-10-21","2026-10-13",true,{"@type":52,"interactionType":53,"userInteractionCount":30},"InteractionCounter",{"@type":54},"ViewAction",{"@type":56,"mainEntity":57},"FAQPage",[58,64,68],{"name":59,"@type":60,"acceptedAnswer":61},"文档主要涵盖哪些阶段的内容？","Question",{"text":62,"@type":63},"文档按“Discovering/Enumerating/Attacking”对流程进行分段，分别对应信息收集、枚举与漏洞/攻击相关主题。","Answer",{"name":65,"@type":60,"acceptedAnswer":66},"在信息收集部分如何进行 IP 与子域名枚举？",{"text":67,"@type":63},"通过 IP Enumeration 与 Subdomain Enumeration 相关方法与工具条目完成目标资产识别，并结合字典/被动信息来源与公开数据。",{"name":69,"@type":60,"acceptedAnswer":70},"攻击阶段列出了哪些常见漏洞利用方向？",{"text":71,"@type":63},"列出多种利用与检测主题，例如 SQLi、XSS、SSRF、DNS Rebinding、LFI、SSTI、信息泄露以及 WebDAV 等。","https://schema.org",{"og:url":32,"og:type":74,"og:title":10,"og:site_name":45,"og:description":12},"article",{"robots":76,"canonical":32},"index,follow",{"doc_id":78,"site_id":7},572764,1792481661,{"code":4,"msg":81,"data":82},"success",[83,88,93,98,103,108,113,118,123],{"id":84,"doc_module":22,"doc_module_name":25,"category_name":85,"show_sort_weight":86,"slug":87},11,"Presentations",90,"presentations",{"id":89,"doc_module":22,"doc_module_name":25,"category_name":90,"show_sort_weight":91,"slug":92},12,"Resumes",80,"resumes",{"id":94,"doc_module":22,"doc_module_name":25,"category_name":95,"show_sort_weight":96,"slug":97},14,"Invoices",70,"invoices",{"id":99,"doc_module":22,"doc_module_name":25,"category_name":100,"show_sort_weight":101,"slug":102},15,"Posters",60,"posters",{"id":104,"doc_module":22,"doc_module_name":25,"category_name":105,"show_sort_weight":106,"slug":107},16,"Social Media",50,"social-media",{"id":109,"doc_module":22,"doc_module_name":25,"category_name":110,"show_sort_weight":111,"slug":112},17,"Forms",40,"forms",{"id":114,"doc_module":22,"doc_module_name":25,"category_name":115,"show_sort_weight":116,"slug":117},18,"Letters",30,"letters",{"id":119,"doc_module":22,"doc_module_name":25,"category_name":120,"show_sort_weight":121,"slug":122},21,"Paper Templates",5,"papers-templates",{"id":124,"doc_module":22,"doc_module_name":25,"category_name":29,"show_sort_weight":4,"slug":125},158,"general-158",{"code":4,"msg":81,"data":127},{"doc_id":78,"user_id":128,"nickname":42,"user_avatar":129,"doc_module":22,"category_id":124,"category_name":29,"doc_title":10,"doc_description":12,"doc_content":130,"file_id":131,"file_url":132,"file_type":133,"file_size":134,"view_count":30,"is_deleted":4,"is_public":22,"is_downloadable":22,"audit_status":22,"page_count":135,"language":136,"language_code":8,"site_id":7,"html_lang":8,"table_of_contents":137,"faqs":138,"seo_title":139,"seo_description":12,"update_tm":140,"read_time":99},137455077381,"https://ap-avatar.wpscdn.com/davatar_994ba38a5ba835b3df7d355c54d3ed8d","Web Attack Cheat Sheet  \nTable of Contents  \n Discovering  \n Targets  \n IP Enumeration  \n Subdomain Enumeration  \n Wayback Machine  \n Cache  \n Crawling  \n Wordlist  \n Directory Bruteforcing  \n Parameter Bruteforcing  \n DNS and [HTTP detection](HTTP detection)  \n Acquisitions/Names/Addresses/Contacts/Emails/etc.  \n HTML/JavaScript Comments  \n Google Dorks  \n Content Security Policy (CSP)  \n Tiny URLs Services  \n GraphQL  \n General  \n Enumerating  \n Fingerprint  \n Buckets  \n Cloud Enumeration  \n Containerization  \n Visual Identification  \n Scanning  \n Static Application Security Testing  \n Dependency Confusion  \n Send Emails  \n Search Vulnerabilities  \n Web Scanning  \n [HTTP Request Smuggling](HTTP Request Smuggling)  \n Subdomain Takeover  \n SQLi (SQL Injection)  XSS  \n Repositories Scanning  \n Secret Scanning  \n Google Dorks Scanning  \n CORS Misconfigurations  \n Monitoring  CVE  \n Attacking  \n Brute Force  \n Exfiltration  \n General  \n Manual  \n Payloads  \n Bypass  \n Deserialization  \n SSRF (Server-Side Request Forgery)  \n DNS Rebinding  \n SMTP Header Injection  \n Reverse Shell  \n SQLi (SQL Injection)  XSS  \n XPath Injection  \n LFI (Local File Inclusion)  \n SSTI (Server Side Template Injection)  \n Information Disclosure  \n WebDAV (Web Distributed Authoring and Versioning)  \n Generic Tools  \n General  \nDiscovering  \nTargets  \n[https://github.com/arkadiyt/bounty-targets-data](https://github.com/arkadiyt/bounty-targets-data)  \n\\# This repo contains data dumps of Hackerone and Bugcrowd scopes (i.e. the domains that are eligible for bug bounty reports) .  \nIP Enumeration  \n[http://www.asnlookup.com](http://www.asnlookup.com)  \n\\# This tool leverages ASN to look up IP addresses (IPv4 & IPv6) owned by a specific organization for reconnaissance purposes.  \n[https://github.com/pielco11/fav-up](https://github.com/pielco11/fav-up)  \n\\# Lookups for real IP starting from the favicon icon and using Shodan. python3 favUp .py--favicon-file favicon .ico-sc  \n[https://stackoverflow.com/questions/16986879/bash-script-to-list-all-ips-in-prefix](https://stackoverflow.com/questions/16986879/bash-script-to-list-all-ips-in-prefix)  \n[\\# List all IP addresses in a given CIDR block](# List all IP addresses in a given CIDR block)  \nnmap-sL-n 10 .10 .64 .0/27 | awk '/Nmap scan report/{print $NF}'  \n[https://kaeferjaeger.gay/?dir=cdn-ranges/](https://kaeferjaeger.gay/?dir=cdn-ranges/)  \n\\# Lists of IP ranges used by CDNs (Cloudflare, Akamai, Incapsula, Fastly, etc) . Updated every 30 minutes.  \n[https://kaeferjaeger.gay/?dir=ip-ranges/](https://kaeferjaeger.gay/?dir=ip-ranges/)  \n\\# Lists of IP ranges from: Google (Cloud & GoogleBot), Bing (Bingbot), Amazon (AWS), Microsoft (Azure), Oracle (Cloud) and DigitalOcean. Updated every 6 hours.  \n[https://netlas.io/](https://netlas.io/)  \n\\# Internet intelligence apps that provide accurate technical information on IP addresses, domain names, websites, web applications, IoT devices, and other online assets.  \nSubdomain Enumeration  \n[https://web.archive.org/web/20211127183642/](https://web.archive.org/web/20211127183642/) [https://appsecco.com/books/subdomain](https://appsecco.com/books/subdomain)enumeration/  \n\\# This book intendes to be a reference for subdomain enumeration techniques.  \n[https://github.com/knownsec/ksubdomain](https://github.com/knownsec/ksubdomain)  \n\\# ksubdomain是⼀款基于⽆状态⼦域名爆破⼯具，⽀持在Windows/Linux/Mac上使⽤，它会很快的进⾏DNS爆破，在Mac和Windows上理论最⼤发包速度在30w/s,linux上为160w/s的速度。 ksubdomain-d [example.com](example.com)  \n[https://github.com/OWASP/Amass](https://github.com/OWASP/Amass)  \n\\# The OWASP Amass Project performs network mapping of attack surfaces and external asset  \ndiscovery using open source information gathering and active reconnaissance techniques. amass [enum-passive-dir /tmp/amass_output/ -d example.com-o dir/example.com](enum-passive-dir /tmp/amass_output/ -d example.com-o dir/example.com)  \n[https://github.com/projectdiscovery/subfinder](https://github.com/projectdiscovery/subfinder)  \n\\# subfin","cbCaif2wA5K6fMYm","https://ap.wps.com/l/cbCaif2wA5K6fMYm","pdf",211390,42,"English","# Discovering\n## Targets\n## IP Enumeration\n## Subdomain Enumeration\n## Wayback Machine\n## Cache\n## Crawling\n## Wordlist\n## Directory Bruteforcing\n## Parameter Bruteforcing\n## DNS and HTTP detection\n## Acquisitions/Names/Addresses/Contacts/Emails/etc.\n## HTML/JavaScript Comments\n## Google Dorks\n## Content Security Policy (CSP)\n## Tiny URLs Services\n## GraphQL\n# Enumerating\n## Fingerprint\n## Buckets\n## Cloud Enumeration\n## Containerization\n## Visual Identification\n## Scanning\n## Static Application Security Testing\n## Dependency Confusion\n## Send Emails\n## Search Vulnerabilities\n## Web Scanning\n## HTTP Request Smuggling\n## Subdomain Takeover\n## SQLi and XSS\n## Repositories Scanning\n## Secret Scanning\n## Google Dorks Scanning\n## CORS Misconfigurations\n## Monitoring\n## CVE\n# Attacking\n## Brute Force\n## Exfiltration\n## Manual\n## Payloads\n## Bypass\n## Deserialization\n## SSRF\n## DNS Rebinding\n## SMTP Header Injection\n## Reverse Shell\n## XPath Injection\n## LFI\n## SSTI\n## Information Disclosure\n## WebDAV\n## Generic Tools","[{\"question\":\"文档主要涵盖哪些阶段的内容？\",\"answer\":\"文档按“Discovering/Enumerating/Attacking”对流程进行分段，分别对应信息收集、枚举与漏洞/攻击相关主题。\"},{\"question\":\"在信息收集部分如何进行 IP 与子域名枚举？\",\"answer\":\"通过 IP Enumeration 与 Subdomain Enumeration 相关方法与工具条目完成目标资产识别，并结合字典/被动信息来源与公开数据。\"},{\"question\":\"攻击阶段列出了哪些常见漏洞利用方向？\",\"answer\":\"列出多种利用与检测主题，例如 SQLi、XSS、SSRF、DNS Rebinding、LFI、SSTI、信息泄露以及 WebDAV 等。\"}]","Web Attack Cheat Sheet - Information Gathering | PDF",1791929185]