Vhost Enumeration

Virtual Host Enumeration

Discover hidden virtual hosts on IP addresses by fuzzing the Host header. Many servers only respond to specific domain names and remain invisible to standard subdomain enumeration. VHOST fuzzing exposes internal services, development environments, and admin panels that share the same IP but answer to different hostnames.

When to Use

• You have a list of target IPs from skill_view(name='origin-ip-discovery') or skill_view(name='port-service-discovery').
• A server returns default/blank pages for unknown Host headers.
• Subdomain enumeration may have missed internal-only hostnames.
• SSL certificates on an IP list multiple domain names in the SAN field.
• You need to map internal services behind a reverse proxy.

Prerequisites

• terminal with curl, ffuf, dnsx, and httpx.
• A DNS wordlist for hostname fuzzing.
• A list of target IP addresses.

Quick Detection

bashCopy code
# Basic VHOST fuzz on a single IP
ffuf -u http://TARGET_IP \
  -w /path/to/wordlist.txt \
  -H "Host: FUZZ.target.com" \
  -fs 0 -mc 200,301,302,401,403

Procedure

Phase 1 — Host Header Fuzzing

bashCopy code
# Fuzz for virtual hosts matching the target domain pattern
ffuf -u http://TARGET_IP \
  -w $DNS_WORDLIST \
  -H "Host: FUZZ.target.com" \
  -fs DEFAULT_RESPONSE_SIZE \
  -mc 200,301,302,401,403 \
  -o vhost_ffuf.json

# HTTPS variant
ffuf -u https://target.com \
  -w $DNS_WORDLIST \
  -H "Host: FUZZ.target.com" \
  -mc 200,301,302,401,403

# Fuzz multiple IPs with a wordlist
cat unique_ips.txt | while read ip; do
  ffuf -u "http://$ip" \
    -w $DNS_WORDLIST \
    -H "Host: FUZZ.target.com" \
    -fs 0 -mc 200,301,302 -o "vhost_$ip.json"
  sleep 0.5
done

Phase 2 — Response Filtering

bashCopy code
# Auto-calibrate: ffuf detects default response size and filters it out
ffuf -u http://TARGET_IP \
  -w $DNS_WORDLIST \
  -H "Host: FUZZ.target.com" \
  -ac -sf -s \
  -mc 200

# Manual calibration: find the default response size first
curl --max-time 30 --connect-timeout 10 -s http://TARGET_IP -H "Host: nonexistentxxxxx12345.target.com" | wc -c
# Use that size as -fs filter

Phase 3 — Accessing VHOST Targets

bashCopy code
# Method 1 — direct curl with Host header
curl --max-time 30 --connect-timeout 10 -H "Host: dev.target.com" http://TARGET_IP

# Method 2 — /etc/hosts injection for browser access
echo "TARGET_IP  dev.target.com internal.target.com admin.target.com" | sudo tee -a /etc/hosts
# Then open http://dev.target.com in browser

# Method 3 — httpx with custom host resolution
echo "http://dev.target.com" | httpx -silent

Phase 4 — SSL Certificate SAN Enumeration

bashCopy code
# Extract hostnames from SSL certificate
echo | openssl s_client -connect TARGET_IP:443 -servername target.com 2>/dev/null \
  | openssl x509 -noout -text \
  | grep -Eo 'DNS:[^,\s]+' | cut -d: -f2 | sort -u

# Batch: extract hostnames from all discovered IPs
cat unique_ips.txt | while read ip; do
  echo | timeout 5 openssl s_client -connect $ip:443 2>/dev/null \
    | openssl x509 -noout -text 2>/dev/null \
    | grep -Eo 'DNS:[^,\s]+' | cut -d: -f2 | sort -u >> ssl_hostnames.txt
  sleep 0.5
done

# Check which of those hostnames resolve to the target
cat ssl_hostnames.txt | dnsx -silent -a -resp-only | sort -u

Phase 5 — PTR Reverse DNS on IP Ranges

bashCopy code
# If you have IP ranges, resolve PTR records to find hostnames
echo "10.0.0.0/23" | dnsx -silent -resp-only -ptr

# Batch on multiple CIDR ranges
cat cidr_ranges.txt | mapcidr -silent | dnsx -ptr -resp-only -silent > ptr_domains.txt

Phase 6 — Content Differencing

bashCopy code
# For each found VHOST, take a screenshot for visual triage
cat found_vhosts.txt | gowitness file -f - --no-http -P ./vhost_screenshots/

# Compare content across hosts — different content = different service
for host in $(cat found_vhosts.txt); do
  curl --max-time 30 --connect-timeout 10 -sk "http://TARGET_IP" -H "Host: $host" | md5sum
  sleep 0.3
done | sort

Pitfalls

• Wildcard DNS returns valid HTTP for any Host header. Use auto-calibration (-ac) and verify manually.
• The default virtual host may return a generic page for unknown names. Calibrate -fs with a known-nonexistent hostname.
• SSL/TLS prevents content comparison without SNI. Use openssl s_client -servername for each hostname.
• Some servers accept any Host header. This produces false positives — verify each finding with manual curl.
• Internal-only services may not be accessible from your IP. They may require internal network access.

Verification

1. ffuf returns a status code and response size different from the calibrated default.
2. Manual curl with the discovered Host header returns meaningful content (not the default page).
3. The discovered hostname is not in the public subdomain list (previously unknown).
4. SSL certificate SAN field confirms the hostname belongs on this server.
5. Take a screenshot and confirm it's a distinct application or service.

Related Skills

• subdomain-enumeration — Generate the DNS wordlist and existing subdomains.
• origin-ip-discovery — Find the origin IPs that need VHOST scanning.
• web-enumeration — Once VHOSTs are found, fuzz directories and endpoints.