Vhost Enumeration

# Basic VHOST fuzz on a single IP
ffuf -u http://TARGET_IP \
  -w /path/to/wordlist.txt \
  -H "Host: FUZZ.target.com" \
  -fs 0 -mc 200,301,302,401,403

# Fuzz for virtual hosts matching the target domain pattern
ffuf -u http://TARGET_IP \
  -w $DNS_WORDLIST \
  -H "Host: FUZZ.target.com" \
  -fs DEFAULT_RESPONSE_SIZE \
  -mc 200,301,302,401,403 \
  -o vhost_ffuf.json

# HTTPS variant
ffuf -u https://target.com \
  -w $DNS_WORDLIST \
  -H "Host: FUZZ.target.com" \
  -mc 200,301,302,401,403

# Fuzz multiple IPs with a wordlist
cat unique_ips.txt | while read ip; do
  ffuf -u "http://$ip" \
    -w $DNS_WORDLIST \
    -H "Host: FUZZ.target.com" \
    -fs 0 -mc 200,301,302 -o "vhost_$ip.json"
  sleep 0.5
done

# Auto-calibrate: ffuf detects default response size and filters it out
ffuf -u http://TARGET_IP \
  -w $DNS_WORDLIST \
  -H "Host: FUZZ.target.com" \
  -ac -sf -s \
  -mc 200

# Manual calibration: find the default response size first
curl --max-time 30 --connect-timeout 10 -s http://TARGET_IP -H "Host: nonexistentxxxxx12345.target.com" | wc -c
# Use that size as -fs filter

# Method 1 — direct curl with Host header
curl --max-time 30 --connect-timeout 10 -H "Host: dev.target.com" http://TARGET_IP

# Method 2 — /etc/hosts injection for browser access
echo "TARGET_IP  dev.target.com internal.target.com admin.target.com" | sudo tee -a /etc/hosts
# Then open http://dev.target.com in browser

# Method 3 — httpx with custom host resolution
echo "http://dev.target.com" | httpx -silent

# Extract hostnames from SSL certificate
echo | openssl s_client -connect TARGET_IP:443 -servername target.com 2>/dev/null \
  | openssl x509 -noout -text \
  | grep -Eo 'DNS:[^,\s]+' | cut -d: -f2 | sort -u

# Batch: extract hostnames from all discovered IPs
cat unique_ips.txt | while read ip; do
  echo | timeout 5 openssl s_client -connect $ip:443 2>/dev/null \
    | openssl x509 -noout -text 2>/dev/null \
    | grep -Eo 'DNS:[^,\s]+' | cut -d: -f2 | sort -u >> ssl_hostnames.txt
  sleep 0.5
done

# Check which of those hostnames resolve to the target
cat ssl_hostnames.txt | dnsx -silent -a -resp-only | sort -u

# If you have IP ranges, resolve PTR records to find hostnames
echo "10.0.0.0/23" | dnsx -silent -resp-only -ptr

# Batch on multiple CIDR ranges
cat cidr_ranges.txt | mapcidr -silent | dnsx -ptr -resp-only -silent > ptr_domains.txt

# For each found VHOST, take a screenshot for visual triage
cat found_vhosts.txt | gowitness file -f - --no-http -P ./vhost_screenshots/

# Compare content across hosts — different content = different service
for host in $(cat found_vhosts.txt); do
  curl --max-time 30 --connect-timeout 10 -sk "http://TARGET_IP" -H "Host: $host" | md5sum
  sleep 0.3
done | sort