🌐
Subdomain Enumeration Guide
  • Home 🏠
  • Introduction
    • What's the need ?🤔
    • Prerequisites
  • Types
    • Horizontal Enumeration
    • Vertical Enumeration
  • Passive Techniques
    • Passive Sources
    • Certificate Logs
    • Recursive Enumeration
  • Active Techniques
    • DNS Bruteforcing
    • Permutation/Alterations
    • Scraping(JS/Source code)
    • Google analytics
    • TLS, CSP, CNAME Probing
    • VHOST probing
  • Web probing
  • Automation 🤖
Powered by GitBook
On this page
  • What is Virtual Host?
  • How does this actually work?
  • How to identity VHOST on a single IP?
  • HostHunter
  • VHOST bruteforcing

Was this helpful?

  1. Active Techniques

VHOST probing

PreviousTLS, CSP, CNAME ProbingNextWeb probing

Last updated 3 years ago

Was this helpful?

What is Virtual Host?

VHOST(Virtual Host) refers to the practice of running more than one website (such as company1.example.com and company2.example.com) on a single machine.

There are mainly 2 types of Virtual hosts:

  1. IP-based Virtual Host:

    In IP-based Virtual Host, we have different IP addresses for every website.

  2. Name-based Virtual Host:✔️

    In named-based Virtual Host, several websites are hosted on the same IP. Mostly this type is widely and preferred in order to preserve IP space.

But when talking about VHOST we are generally talking about Named-based Virtual hosts.

How does this actually work?

Now, you would be confused about how will the webserver differentiate to which website it has to send my requests since many websites are being hosted on the same server with the same IP.

It's through the "Host header". The web server identifies which content to serve up once it receives the Host header from the client.

How to identity VHOST on a single IP?

  • Language: Python

Installation:

git clone https://github.com/SpiderLabs/HostHunter.git
pip3 install -r requirements.txt

Running:

python3 hosthunter.py ip_addresses.txt

VHOST bruteforcing

Sorry to say, I couldn't find appropriate content around the internet related to this topic. Me myself don't use this technique, but yes this is also an technique to discover VHOSTS

gobuster vhost -u https://example.com -t 50 -w subdomains.txt

For this purpose, we can use a tool called.

Author:

HostHunter
HostHunter
SpiderLabs
A total of 336 websites are hosted on the same IP