Background search, how to find the website background

1. Weak password defaults to background password

admin,admin/login.asp,manage,login.asp And so on

---

2. Check out the links on the web

Generally speaking , The homepage of the website has management login and similar things , Some may be deleted by the Administrator

---

3. Use tools to find

• Not by default , Consider using the imperial sword + The dictionary runs in the background directory
• The background address is complex , Consider crawling websites , Like using a crawling kitchen knife ,Web robot
• With the help of Google-hacker Construction lookup

web robot demonstration ：

Open the robot and select the web spider ：

Right click to add URL To list ：

Start crawling ：

---

4.robots.txt With the help of the

robots.txt The file tells the spider what kind of file can be viewed on the server

---

5. Picture attribute

The image attribute path exposes the background location

---

6. Editor leaks

Check whether the editor used by the website has a default background

---

7. Short file utilization

---

8. utilize sqlmap

sqlmap --sql-shell  load_file('d:/wwroot/index.php');

---

9. The background is not on the same site

• Port background
• Subdomain background
• Check the side station of the same server
• CSS style ,JS Code remote link Disclose the background address