> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/reconnaissance/google-dorking.md).

# Google Dorking

Google Dorking 使用高级搜索运算符来查找已索引的文件、暴露的管理面板、备份、凭据、日志以及其他敏感信息。

{% hint style="info" %}
通过 Google 发现网站上暴露信息的方法有很多种。以下是一系列对此类研究有用的示例和技术：
{% endhint %}

## 方法

维护中的 Google dorking 和网站研究工具目录可在以下位置获取 [网站与基础设施](/zh/hacking-tools/osint/websites-and-infrastructure.md)。使用此页面查看查询模式和调查工作流程。

替换 `target.com` 为已授权的域名或范围。对于子域名范围的检查，请保留通配符形式 `site:*.target.com`；对于单个主机，请使用 `site:app.target.com`.

核心运算符：

* `site:` 将结果限制为目标域名或主机。
* `intext:` 搜索已索引页面中的文本。
* `intitle:` 在页面标题中搜索。
* `inurl:` 在已索引的 URL 中搜索。
* `ext:` 或 `filetype:` 搜索已索引的文件扩展名。

## 通用查询

使用这些来查找已索引的错误、调试痕迹、管理路径、环境名称以及常见的信息泄露指示。

```
site:*.target.com intext:uncaught
site:*.target.com intext:error
site:*.target.com intext:parameter
site:*.target.com intext:missing
site:*.target.com intext:"stack trace"
site:*.target.com intext:php
site:*.target.com intext:jsp
site:*.target.com intext:asp
site:*.target.com intext:include_path
site:*.target.com intext:undefined
site:*.target.com intext:sql
site:*.target.com intext:invalid
site:*.target.com intext:exception
site:*.target.com intext:fatal
site:*.target.com intext:CONFIG
site:*.target.com intext:login
site:*.target.com intitle:"index of"
site:*.target.com inurl:prod
site:*.target.com inurl:&
site:*.target.com inurl:dev
site:*.target.com inurl:staging
site:*.target.com inurl:stg
site:*.target.com inurl:debug
site:*.target.com inurl:admin
site:*.target.com inurl:internal
```

## Apache 服务

使用这些来识别默认页面、暴露的状态页面、Tomcat 实例、Solr 管理面板以及与 Apache 服务相关的目录列表。

```
site:*.target.com intitle:"apache tomcat/"
site:*.target.com "Apache Tomcat examples"
site:*.target.com intext:"apache"
site:*.target.com intitle:"Solr Admin"
site:*.target.com intext:"This is the default welcome page used to test the correct operation of the Apache2 server"
site:*.target.com intitle:"index of" "powered by apache "
site:*.target.com intext:"Apache server status for"
site:*.target.com intitle:"Apache2 Ubuntu Default Page: It works"
site:*.target.com intitle:"WAMPSERVER homepage" "Server Configuration" "Apache Version"
site:*.target.com intitle:"Test Page for the Apache HTTP Server"
```

## 文件

使用这些来查找已索引的源代码文件、备份、日志、配置文件、密钥、导出文件、日历以及结构化数据文件。优先进行手动验证，并避免在授权规则之外下载或使用敏感数据。

```
site:*.target.com ext:txt
site:*.target.com ext:php
site:*.target.com ext:php5
site:*.target.com ext:phtml
site:*.target.com ext:xhtml
site:*.target.com ext:key
site:*.target.com ext:pem
site:*.target.com ext:ovpn
site:*.target.com ext:log
site:*.target.com ext:asp
site:*.target.com ext:aspx
site:*.target.com ext:jsp
site:*.target.com ext:dat
site:*.target.com ext:yml
site:*.target.com ext:bak
site:*.target.com ext:zip
site:*.target.com ext:yaml
site:*.target.com ext:json
site:*.target.com ext:xml
site:*.target.com ext:env
site:*.target.com ext:conf
site:*.target.com ext:ini
site:*.target.com ext:cfg
site:*.target.com ext:cgi
site:*.target.com ext:ccm
site:*.target.com ext:sql
site:*.target.com ext:cdx
site:*.target.com ext:ics
```

## GraphQL 查询

使用这些来发现已索引的 GraphQL 错误响应、验证消息以及与授权相关的 API 痕迹。

```
site:*.target.com intext:"GRAPHQL_PARSE_FAILED"
site:*.target.com intext:"GRAPHQL_VALIDATION_FAILED"
site:*.target.com intext:"BAD_USER_INPUT"
site:*.target.com intext:"UNAUTHENTICATED"
site:*.target.com intext:"FORBIDDEN"
site:*.target.com intext:"PERSISTED_QUERY_NOT_FOUND"
site:*.target.com intext:"PERSISTED_QUERY_NOT_SUPPORTED"
site:*.target.com intext:"INTERNAL_SERVER_ERROR"
```

## 快速工作流程

1. 先从宽泛的 `site:*.target.com` 以及通用错误查询开始。
2. 再转向特定技术的检查，例如 Apache、Tomcat、Solr、PHP、ASP.NET、JSP 或 GraphQL。
3. 搜索通常会暴露备份、日志、配置或密钥的已索引文件类型。
4. 记录精确的查询、结果 URL、时间戳，以及该暴露为何重要。
5. 仅在授权范围和规则约束内验证影响。


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://hacking-notes.jord4n.pro/zh/reconnaissance/google-dorking.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.