Virtual Hosts (VHOSTS)

Virtual Hosts (VHOSTS) Enumeration

We can find virtual hosts for websites by enumerating Host header value.

Enumeration

# Ffuf
ffuf -u http://example.com/ -H "Host: FUZZ.example.com" -w wordlist.txt -fs 1234
# follow redirect (-r)
ffuf -u http://example.com/ -H "Host: FUZZ.example.com" -w wordlist.txt -fs 1234 -r
# Sometimes, we have to specify the ip address not domain.
ffuf -u http://10.0.0.1/ -H "Host: FUZZ.example.com" -w wordlist.txt -fs 1234

# Wfuzz
wfuzz -u http://example.com -H "Host: FUZZ.example.com" -w wordlist.txt --hl 138

Add Vhosts to Hosts File

If we found a vhost, add that ip&domain to the hosts file depending on your attack machine.

• Linux: /etc/hosts

• Windows: C:\Windows\System32\drivers\etc\hosts

Related Domains

If we find the vhosts, we can try to search moreover with keywords. For instance, assume we found “sub” domain.

sub-api.example.com
sub-dev.example.com
sub-prod.example.com
sub-mail.example.com
sub-email.example.com

api-sub.example.com
dev-sub.example.com
prod-sub.example.com
mail-sub.example.com
email-sub.example.com

OSINT

• nmmapper

SAN (Subject Alternative Name) in the Certificate

SAN is an extension to X.509 that allows various values to be associated with a security certificate using a subjectAltName field. We can also check it for finding subdomains. Replace "example.com" with your target domain.

openssl s_client -connect example.com:443 < /dev/null | openssl x509 -noout -text |

Tools

virtual-host-discovery

https://github.com/jobertabma/virtual-host-discovery

Example:

ruby scan.rb --ip=192.168.1.101 --host=domain.tld

vhosts-sieve

https://github.com/dariusztytko/vhosts-sieve

Example:

python3 vhosts-sieve.py -d domains.txt -o vhosts.txt

fierce

(fierce DNS scanner)

Example:

fierce -dns example.com

VHostScan

https://github.com/codingo/VHostScan

Example:

VHostScan -t example.com

Techniques

Reference: https://pentestbook.six2dez.com/enumeration/webservices/vhosts#techniques

Copy of common techniques:

# ffuf
badresponse=$(curl -s -H "host: totallynotexistsforsure.bugcrowd.com" https://bugcrowd.com | wc -c)
ffuf -u https://TARGET.com -H "Host: FUZZ.TARGET.com" -w werdlists/dns-hostnames/nmap-vhosts-all.txt -fs $badresponse

# Manual with subdomains list
for sub in $(cat subdomains.txt); do
    echo "$sub $(dig +short a $sub | tail -n1)" | anew -q subdomains_ips.txt
done