> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/reconnaissance.md).

# 侦察

侦察是渗透测试的第一阶段。目标是绘制目标攻击面、识别暴露的服务、发现子域名，并对 Web 技术进行指纹识别。

本节介绍在渗透测试、CTF 评估和外部攻击面审查中使用的实用侦察技术。

## 侦察工作流

1. 识别存活主机和暴露的服务。
2. 枚举开放端口和服务版本。
3. 发现目录、文件、参数和隐藏的 Web 资源。
4. 枚举子域名、DNS 记录和公共基础设施。
5. 对 Web 技术、框架、CMS、服务器和版本进行指纹识别。
6. 将公开来源研究和外部 OSINT 工作发送到专门的 Hacking Tools OSINT 中心。

## 侦察技术

<table data-view="cards" data-full-width="false" data-search="false"><thead><tr><th></th><th></th><th></th><th data-hidden data-card-target data-type="content-ref"></th></tr></thead><tbody><tr><td><h3><i class="fa-eye" style="color:$primary;">:eye:</i></h3></td><td><h4>Nmap</h4></td><td>用于端口扫描、服务检测、NSE 脚本、主机发现、防火墙规避和漏洞扫描的 Nmap 侦察笔记。</td><td><a href="/pages/930c55150c98fb3a6093d08fd37654e93070ef5d">/pages/930c55150c98fb3a6093d08fd37654e93070ef5d</a></td></tr><tr><td><h3><i class="fa-folder-open" style="color:$primary;">:folder-open:</i></h3></td><td><h4>Web 模糊测试</h4></td><td>使用 Gobuster 和 Wfuzz 等工具发现隐藏目录、文件、扩展名、参数和暴露资源的 Web 模糊测试方法。</td><td><a href="/pages/63fd481f8ed47c55bcdb0d23fa4d6bbd8c9dfeb9">/pages/63fd481f8ed47c55bcdb0d23fa4d6bbd8c9dfeb9</a></td></tr><tr><td><h3><i class="fa-earth-europe" style="color:$primary;">:earth-europe:</i></h3></td><td><h4>子域</h4></td><td>用于发现公共 DNS 记录、证书透明度条目、已索引主机和暴露基础设施的子域名枚举技术。</td><td><a href="/pages/72589566bb64139b03f42051fab0c95bc4923696">/pages/72589566bb64139b03f42051fab0c95bc4923696</a></td></tr><tr><td><h3><i class="fa-fingerprint" style="color:$primary;">:fingerprint:</i></h3></td><td><h4>Web 指纹分析</h4></td><td>用于识别目标网站上的技术、框架、CMS、服务器、库和暴露版本的 Web 指纹分析技术。</td><td><a href="/pages/5f4a5b84b513075412c2db843b94146221d0e25d">/pages/5f4a5b84b513075412c2db843b94146221d0e25d</a></td></tr><tr><td><h3><i class="fa-google" style="color:$primary;">:google:</i></h3></td><td><h4>Google 语法搜索</h4></td><td>用于在侦察期间查找已索引的敏感文件、暴露的面板、备份、泄露信息和公开信息的 Google 语法搜索技术。</td><td><a href="/pages/6142228cb3b04dc6108419ca3c21ae887f3c44f3">/pages/6142228cb3b04dc6108419ca3c21ae887f3c44f3</a></td></tr></tbody></table>

\## 推荐工具

* [Nmap](/zh/reconnaissance/nmap.md) 用于端口扫描、服务检测、NSE 脚本和防火墙规避。
* [Web 模糊测试](/zh/reconnaissance/web-fuzzing.md) 使用 Gobuster 和 Wfuzz 等工具发现目录、文件和参数。
* [子域名枚举](/zh/reconnaissance/subdomains.md) 结合 DNS 查询、证书透明度、Google 语法搜索和公共数据集。
* [Web 指纹分析](/zh/reconnaissance/web-profiling.md) 使用 WhatWeb、Wappalyzer 和 BuiltWith 来识别目标技术栈。
* [Google 语法搜索](/zh/reconnaissance/google-dorking.md) 用于查找已索引的敏感文件、暴露的面板、备份和公开信息。
* [OSINT 和研究工具](/zh/hacking-tools/osint.md) 用于电子邮件、泄露信息、元数据、电话号码和公开身份关联。


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://hacking-notes.jord4n.pro/zh/reconnaissance.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.