# Virtual Host {% embed url="" %} The key difference between VHosts and sub-domains is that a VHost is basically a 'sub-domain' served on the same server and has the same IP, such that a single IP could be serving two or more different websites. {% hint style="info" %} *`VHosts may or may not have public DNS records.`* {% endhint %} ```shell-session $ curl -s http://192.168.10.10 -H "Host: randomtarget.com" Welcome to randomtarget.com!

Success! The randomtarget.com server block is working!

``` ## Wordlists ### Seclists `/opt/useful/SecLists/Discovery/DNS/namelist.txt` ### Avileox {% embed url="" %} ### Assetnote {% embed url="" %} ## Gobuster ``` gobuster vhost -u http://domain.htb:8008 -w /usr/share/seclists/Discovery/DNS/namelist.txt --append-domain | grep -v "301" ``` Shorter list: ``` gobuster vhost -u http://inlanefreight.htb:81 -w /usr/share/SecLists/Discovery/DNS/subdomains-top1million-110000.txt --append-domain ``` ## Custom vHost List ```shell-session app blog dev-admin forum help m my shop some store support www ``` ## Fuzzing ```shell-session cat ./vhosts | while read vhost;do echo "\n********\nFUZZING: ${vhost}\n********";curl -s -I http://192.168.10.10 -H "HOST: ${vhost}.randomtarget.com" | grep "Content-Length: ";done ``` ## Ffuf ### Exclude redirect 302 ``` ffuf -u http://permx.htb -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt -H "Host: FUZZ.permx.htb" -fs 0 -mc all -fc 302 ``` ### Filter by size ```shell-session ffuf -w ./vhosts -u http://192.168.10.10 -H "HOST: FUZZ.randomtarget.com" -fs 612 ``` * `-w`: Path to our wordlist * `-u`: URL we want to fuzz * `-H "HOST: FUZZ.randomtarget.com"`: This is the `HOST` Header, and the word `FUZZ` will be used as the fuzzing point. * `-fs 612`: Filter responses with a size of 612, default response size in this case.
``` ffuf -w /usr/share/wordlists/seclists/Discovery/DNS/namelist.txt -u http://10.129.221.4 -H "HOST: FUZZ.inlanefreight.htb" -fs 10918 ```
```shell-session ffuf -w /opt/useful/SecLists/Discovery/DNS/subdomains-top1million-5000.txt:FUZZ -u http://academy.htb:PORT/ -H 'Host: FUZZ.academy.htb' ``` ## [Earn Free Crypto / BTC with Cointiply](https://cointiply.com/r/pkZxp) [**Play Games Earn Cash Rewards**](https://cointiply.com/r/pkZxp)
## Resources {% embed url="" %} {% embed url="" %}