> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/reconnaissance/google-dorking.md).

# Google 高级语法搜寻

Google 高级语法搜寻技术，用于在侦察阶段查找已索引的敏感文件、暴露的面板、备份、泄露内容和公开信息。

Google Dorking 使用高级搜索运算符来查找已索引的文件、暴露的管理面板、备份、凭据、日志以及其他敏感信息。

{% hint style="info" %}
有多种方法可以通过 Google 发现网站上暴露的信息。以下是一系列适用于此类研究的示例和技术：
{% endhint %}

## 方法

Google dorking 和网站研究工具的维护目录位于 [网站与基础设施](/zh/hacking-tools/osint/websites-and-infrastructure.md)。请将此页面用于查询模式和调查流程。

替换 `target.com` 以及授权的域名或范围。对于整个子域的检查，请保留通配符形式 `site:*.target.com`；对于单个主机，请使用 `site:app.target.com`.

核心运算符：

* `site:` 将结果限制在目标域名或主机。
* `intext:` 在已索引页面中搜索文本。
* `intitle:` 在页面标题中搜索。
* `inurl:` 在已索引的 URL 中搜索。
* `ext:` 或 `filetype:` 搜索已索引的文件扩展名。

## 通用查询

使用这些查询来查找已索引的错误、调试痕迹、管理路径、环境名称和常见的信息泄露指示。

```
site:*.target.com intext:未捕获
site:*.target.com intext:错误
site:*.target.com intext:参数
site:*.target.com intext:缺失
site:*.target.com intext:"堆栈跟踪"
site:*.target.com intext:php
site:*.target.com intext:jsp
site:*.target.com intext:asp
site:*.target.com intext:include_path
site:*.target.com intext:未定义
site:*.target.com intext:sql
site:*.target.com intext:无效
site:*.target.com intext:异常
site:*.target.com intext:致命
site:*.target.com intext:CONFIG
site:*.target.com intext:登录
site:*.target.com intitle:"index of"
site:*.target.com inurl:prod
site:*.target.com inurl:&
site:*.target.com inurl:dev
site:*.target.com inurl:staging
site:*.target.com inurl:stg
site:*.target.com inurl:debug
site:*.target.com inurl:admin
site:*.target.com inurl:internal
```

## Apache 服务

使用这些查询来识别默认页面、暴露的状态页面、Tomcat 实例、Solr 管理面板以及与 Apache 服务相关的目录列表。

```
site:*.target.com intitle:"apache tomcat/"
site:*.target.com "Apache Tomcat 示例"
site:*.target.com intext:"apache"
site:*.target.com intitle:"Solr Admin"
site:*.target.com intext:"这是用于测试 Apache2 服务器正确运行的默认欢迎页"
site:*.target.com intitle:"index of" "由 apache 提供支持"
site:*.target.com intext:"Apache 服务器状态："
site:*.target.com intitle:"Apache2 Ubuntu 默认页面：It works"
site:*.target.com intitle:"WAMPSERVER 主页" "服务器配置" "Apache 版本"
site:*.target.com intitle:"Apache HTTP 服务器测试页面"
```

## 文件

使用这些查询来查找已索引的源文件、备份、日志、配置文件、密钥、导出文件、日历和结构化数据文件。优先进行手动验证，并避免在授权范围和交战规则之外下载或使用敏感数据。

```
site:*.target.com ext:txt
site:*.target.com ext:php
site:*.target.com ext:php5
site:*.target.com ext:phtml
site:*.target.com ext:xhtml
site:*.target.com ext:key
site:*.target.com ext:pem
site:*.target.com ext:ovpn
site:*.target.com ext:log
site:*.target.com ext:asp
site:*.target.com ext:aspx
site:*.target.com ext:jsp
site:*.target.com ext:dat
site:*.target.com ext:yml
site:*.target.com ext:bak
site:*.target.com ext:zip
site:*.target.com ext:yaml
site:*.target.com ext:json
site:*.target.com ext:xml
site:*.target.com ext:env
site:*.target.com ext:conf
site:*.target.com ext:ini
site:*.target.com ext:cfg
site:*.target.com ext:cgi
site:*.target.com ext:ccm
site:*.target.com ext:sql
site:*.target.com ext:cdx
site:*.target.com ext:ics
```

## GraphQL 查询

使用这些查询来发现已索引的 GraphQL 错误响应、验证消息以及与授权相关的 API 痕迹。

```
site:*.target.com intext:"GRAPHQL_PARSE_FAILED"
site:*.target.com intext:"GRAPHQL_VALIDATION_FAILED"
site:*.target.com intext:"BAD_USER_INPUT"
site:*.target.com intext:"UNAUTHENTICATED"
site:*.target.com intext:"FORBIDDEN"
site:*.target.com intext:"PERSISTED_QUERY_NOT_FOUND"
site:*.target.com intext:"PERSISTED_QUERY_NOT_SUPPORTED"
site:*.target.com intext:"INTERNAL_SERVER_ERROR"
```

## 快速工作流程

1. 先从以下内容开始： `site:*.target.com` 以及通用错误查询。
2. 再切换到特定技术检查，例如 Apache、Tomcat、Solr、PHP、ASP.NET、JSP 或 GraphQL。
3. 搜索通常会暴露备份、日志、配置或密钥的已索引文件类型。
4. 记录确切的查询、结果 URL、时间戳以及该暴露为何重要。
5. 仅在授权范围和交战规则内验证影响。


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://hacking-notes.jord4n.pro/zh/reconnaissance/google-dorking.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.