Virtual Host Fuzzing

A web server can host several sites on a single IP and decide which one to serve based on the hostname the client asks for in the HTTP Host: header. This is called virtual hosting. The implication for enumeration is significant: the page you see when browsing the IP (or the main domain) may not be the only one; other names can return completely different applications.

That is why, beyond fuzzing directories and files, you should fuzz hostnames. The technique sends many requests to the same IP, varying the Host: header with candidates from a wordlist, and keeps those returning a response different from the wildcard (a host that does not exist). A difference in status code or, above all, in response size betrays a real virtual host.

# gobuster in vhost mode
gobuster vhost -u http://permx.htb \
  -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt \
  --append-domain -t 50

# ffuf equivalent, filtering by the wildcard size
ffuf -u http://10.10.11.23 -H "Host: FUZZ.permx.htb" \
  -w subdomains.txt -fs 19347

Each responding candidate must be added to /etc/hosts pointing at the IP so you can browse it:

echo '10.10.11.23 lms.permx.htb' | sudo tee -a /etc/hosts

Why it matters. Admin applications, internal panels or third-party software installs often live on low-visibility subdomains (dev., lms., admin., internal.). The exploit vector is frequently not on the main site but on one of these virtual hosts.

How to detect it. The access-log signature is a burst of requests to the same IP varying the Host: header (hundreds of distinct values in seconds), most returning the same response size (the wildcard) or 404, a pattern a real client never produces; the gobuster/ffuf User-Agent reinforces it. A WAF or a rate-limit rule on the number of distinct Host: values per source detects it. Requests with a Host: that matches no published vhost are the tell.

Defence. Never assume a subdomain is "secret" just because it is not linked: if it answers, it gets found. Sensitive vhosts should be protected with authentication or network filtering, not left to rely on obscurity.