> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/reconnaissance.md).

# 侦察

用于攻击面映射、子域枚举、Web 模糊测试、Nmap 扫描和技术指纹识别的渗透测试侦察方法。

侦察是渗透测试的第一阶段。其目标是绘制目标攻击面图、识别暴露的服务、发现子域名，并指纹识别 Web 技术。

本节涵盖渗透测试、CTF 评估以及外部攻击面审查中使用的实用侦察技术。

## 侦察工作流程

1. 识别存活主机和暴露的服务。
2. 枚举开放端口和服务版本。
3. 发现目录、文件、参数和隐藏的 Web 资源。
4. 枚举子域名、DNS 记录和公共基础设施。
5. 指纹识别 Web 技术、框架、CMS、服务器和版本。
6. 将公开来源研究和外部 OSINT 工作发送到专门的 Hacking Tools OSINT 中心。

## 侦察技术

<table data-view="cards" data-full-width="false" data-search="false"><thead><tr><th></th><th></th><th></th><th data-hidden data-card-target data-type="content-ref"></th></tr></thead><tbody><tr><td><h3><i class="fa-eye" style="color:$primary;">:eye:</i></h3></td><td><h4>Nmap</h4></td><td>用于端口扫描、服务检测、NSE 脚本、主机发现、防火墙规避和漏洞扫描的 Nmap 侦察笔记。</td><td><a href="/zh/reconnaissance/nmap.md">Nmap</a></td></tr><tr><td><h3><i class="fa-folder-open" style="color:$primary;">:folder-open:</i></h3></td><td><h4>Web 模糊测试</h4></td><td>使用 Gobuster 和 Wfuzz 等工具发现隐藏目录、文件、扩展名、参数和暴露资源的 Web 模糊测试方法。</td><td><a href="/zh/reconnaissance/web-fuzzing.md">Web 模糊测试</a></td></tr><tr><td><h3><i class="fa-earth-europe" style="color:$primary;">:earth-europe:</i></h3></td><td><h4>子域</h4></td><td>用于发现公开 DNS 记录、证书透明度条目、被索引主机和暴露基础设施的子域名枚举技术。</td><td><a href="/zh/reconnaissance/subdomains.md">子域名</a></td></tr><tr><td><h3><i class="fa-fingerprint" style="color:$primary;">:fingerprint:</i></h3></td><td><h4>Web 分析</h4></td><td>用于识别目标网站上的技术、框架、CMS、服务器、库和暴露版本的 Web 分析技术。</td><td><a href="/zh/reconnaissance/web-profiling.md">Web 指纹识别</a></td></tr><tr><td><h3><i class="fa-google" style="color:$primary;">:google:</i></h3></td><td><h4>Google Dorking</h4></td><td>用于在侦察期间查找已被索引的敏感文件、暴露的面板、备份、泄露信息和公开信息的 Google Dorking 技术。</td><td><a href="/zh/reconnaissance/google-dorking.md">Google 高级语法搜寻</a></td></tr></tbody></table>

### 推荐工具

* [Nmap](/zh/reconnaissance/nmap.md) 用于端口扫描、服务检测、NSE 脚本和防火墙规避。
* [Web 模糊测试](/zh/reconnaissance/web-fuzzing.md) 使用 Gobuster 和 Wfuzz 等工具发现目录、文件和参数。
* [子域名枚举](/zh/reconnaissance/subdomains.md) 结合 DNS 查询、证书透明度、Google Dorks 和公开数据集。
* [Web 分析](/zh/reconnaissance/web-profiling.md) 使用 WhatWeb、Wappalyzer 和 BuiltWith 识别目标技术栈。
* [Google Dorking](/zh/reconnaissance/google-dorking.md) 用于查找已被索引的敏感文件、暴露的面板、备份和公开信息。
* [OSINT 与研究工具](/zh/hacking-tools/osint.md) 用于电子邮件、泄露信息、元数据、电话号码和公开身份关联。


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://hacking-notes.jord4n.pro/zh/reconnaissance.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.