> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/web/web-discovery/virtual-host-scanning.md). # Virtual Host Scanning ## Scanning with ffuf Start by checking the default answer size ```bash ┌──(kali㉿kali)-[/mnt/…/TryHackMe/Walkthroughs/Easy/Subdomain_Enumeration] └─$ ffuf -w /usr/share/seclists/Discovery/DNS/namelist.txt -H "Host: FUZZ.acmeitsupport.thm" -u http://10.10.44.56 | head -n 15 /'___\ /'___\ /'___\ /\ \__/ /\ \__/ __ __ /\ \__/ \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\ \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/ \ \_\ \ \_\ \ \____/ \ \_\ \/_/ \/_/ \/___/ \/_/ v2.1.0-dev ________________________________________________ :: Method : GET :: URL : http://10.10.44.56 :: Wordlist : FUZZ: /usr/share/seclists/Discovery/DNS/namelist.txt :: Header : Host: FUZZ.acmeitsupport.thm :: Follow redirects : false :: Calibration : false :: Timeout : 10 :: Threads : 40 :: Matcher : Response status: 200-299,301,302,307,401,403,405,500 ________________________________________________ 0 [Status: 200, Size: 2395, Words: 503, Lines: 52, Duration: 44ms] 11 [Status: 200, Size: 2395, Words: 503, Lines: 52, Duration: 44ms] 3 [Status: 200, Size: 2395, Words: 503, Lines: 52, Duration: 46ms] 03 [Status: 200, Size: 2395, Words: 503, Lines: 52, Duration: 46ms] 02 [Status: 200, Size: 2395, Words: 503, Lines: 52, Duration: 46ms] 01 [Status: 200, Size: 2395, Words: 503, Lines: 52, Duration: 45ms] 1 [Status: 200, Size: 2395, Words: 503, Lines: 52, Duration: 45ms] aacelearning [Status: 200, Size: 2395, Words: 503, Lines: 52, Duration: 48ms] 10 [Status: 200, Size: 2395, Words: 503, Lines: 52, Duration: 48ms] 3com [Status: 200, Size: 2395, Words: 503, Lines: 52, Duration: 48ms] a02 [Status: 200, Size: 2395, Words: 503, Lines: 52, Duration: 48ms] 4 [Status: 200, Size: 2395, Words: 503, Lines: 52, Duration: 48ms] aaaowa [Status: 200, Size: 2395, Words: 503, Lines: 52, Duration: 50ms] aaapi [Status: 200, Size: 2395, Words: 503, Lines: 52, Duration: 49ms] 16 [Status: 200, Size: 2395, Words: 503, Lines: 52, Duration: 50ms] ``` Then filter this size with the `-fs` parameter ```bash ┌──(kali㉿kali)-[/mnt/…/TryHackMe/Walkthroughs/Easy/Subdomain_Enumeration] └─$ ffuf -w /usr/share/seclists/Discovery/DNS/namelist.txt -H "Host: FUZZ.acmeitsupport.thm" -u http://10.10.44.56 -fs 2395 /'___\ /'___\ /'___\ /\ \__/ /\ \__/ __ __ /\ \__/ \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\ \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/ \ \_\ \ \_\ \ \____/ \ \_\ \/_/ \/_/ \/___/ \/_/ v2.1.0-dev ________________________________________________ :: Method : GET :: URL : http://10.10.44.56 :: Wordlist : FUZZ: /usr/share/seclists/Discovery/DNS/namelist.txt :: Header : Host: FUZZ.acmeitsupport.thm :: Follow redirects : false :: Calibration : false :: Timeout : 10 :: Threads : 40 :: Matcher : Response status: 200-299,301,302,307,401,403,405,500 :: Filter : Response size: 2395 ________________________________________________ api [Status: 200, Size: 31, Words: 4, Lines: 1, Duration: 49ms] delta [Status: 200, Size: 51, Words: 7, Lines: 1, Duration: 46ms] yellow [Status: 200, Size: 56, Words: 8, Lines: 1, Duration: 59ms] :: Progress: [151265/151265] :: Job [1/1] :: 796 req/sec :: Duration: [0:03:31] :: Errors: 0 :: ``` ### Usage information
ffuf --help ```bash ┌──(kali㉿kali)-[~] └─$ ffuf --help Fuzz Faster U Fool - v2.1.0-dev HTTP OPTIONS: -H Header `"Name: Value"`, separated by colon. Multiple -H flags are accepted. -X HTTP method to use -b Cookie data `"NAME1=VALUE1; NAME2=VALUE2"` for copy as curl functionality. -cc Client cert for authentication. Client key needs to be defined as well for this to work -ck Client key for authentication. Client certificate needs to be defined as well for this to work -d POST data -http2 Use HTTP2 protocol (default: false) -ignore-body Do not fetch the response content. (default: false) -r Follow redirects (default: false) -raw Do not encode URI (default: false) -recursion Scan recursively. Only FUZZ keyword is supported, and URL (-u) has to end in it. (default: false) -recursion-depth Maximum recursion depth. (default: 0) -recursion-strategy Recursion strategy: "default" for a redirect based, and "greedy" to recurse on all matches (default: default) -replay-proxy Replay matched requests using this proxy. -sni Target TLS SNI, does not support FUZZ keyword -timeout HTTP request timeout in seconds. (default: 10) -u Target URL -x Proxy URL (SOCKS5 or HTTP). For example: http://127.0.0.1:8080 or socks5://127.0.0.1:8080 GENERAL OPTIONS: -V Show version information. (default: false) -ac Automatically calibrate filtering options (default: false) -acc Custom auto-calibration string. Can be used multiple times. Implies -ac -ach Per host autocalibration (default: false) -ack Autocalibration keyword (default: FUZZ) -acs Custom auto-calibration strategies. Can be used multiple times. Implies -ac -c Colorize output. (default: false) -config Load configuration from a file -json JSON output, printing newline-delimited JSON records (default: false) -maxtime Maximum running time in seconds for entire process. (default: 0) -maxtime-job Maximum running time in seconds per job. (default: 0) -noninteractive Disable the interactive console functionality (default: false) -p Seconds of `delay` between requests, or a range of random delay. For example "0.1" or "0.1-2.0" -rate Rate of requests per second (default: 0) -s Do not print additional information (silent mode) (default: false) -sa Stop on all error cases. Implies -sf and -se. (default: false) -scraperfile Custom scraper file path -scrapers Active scraper groups (default: all) -se Stop on spurious errors (default: false) -search Search for a FFUFHASH payload from ffuf history -sf Stop when > 95% of responses return 403 Forbidden (default: false) -t Number of concurrent threads. (default: 40) -v Verbose output, printing full URL and redirect location (if any) with the results. (default: false) MATCHER OPTIONS: -mc Match HTTP status codes, or "all" for everything. (default: 200-299,301,302,307,401,403,405,500) -ml Match amount of lines in response -mmode Matcher set operator. Either of: and, or (default: or) -mr Match regexp -ms Match HTTP response size -mt Match how many milliseconds to the first response byte, either greater or less than. EG: >100 or <100 -mw Match amount of words in response FILTER OPTIONS: -fc Filter HTTP status codes from response. Comma separated list of codes and ranges -fl Filter by amount of lines in response. Comma separated list of line counts and ranges -fmode Filter set operator. Either of: and, or (default: or) -fr Filter regexp -fs Filter HTTP response size. Comma separated list of sizes and ranges -ft Filter by number of milliseconds to the first response byte, either greater or less than. EG: >100 or <100 -fw Filter by amount of words in response. Comma separated list of word counts and ranges INPUT OPTIONS: -D DirSearch wordlist compatibility mode. Used in conjunction with -e flag. (default: false) -e Comma separated list of extensions. Extends FUZZ keyword. -enc Encoders for keywords, eg. 'FUZZ:urlencode b64encode' -ic Ignore wordlist comments (default: false) -input-cmd Command producing the input. --input-num is required when using this input method. Overrides -w. -input-num Number of inputs to test. Used in conjunction with --input-cmd. (default: 100) -input-shell Shell to be used for running command -mode Multi-wordlist operation mode. Available modes: clusterbomb, pitchfork, sniper (default: clusterbomb) -request File containing the raw http request -request-proto Protocol to use along with raw request (default: https) -w Wordlist file path and (optional) keyword separated by colon. eg. '/path/to/wordlist:KEYWORD' OUTPUT OPTIONS: -debug-log Write all of the internal logging to the specified file. -o Write output to file -od Directory path to store matched results to. -of Output file format. Available formats: json, ejson, html, md, csv, ecsv (or, 'all' for all formats) (default: json) -or Don't create the output file if we don't have results (default: false) EXAMPLE USAGE: Fuzz file paths from wordlist.txt, match all responses but filter out those with content-size 42. Colored, verbose output. ffuf -w wordlist.txt -u https://example.org/FUZZ -mc all -fs 42 -c -v Fuzz Host-header, match HTTP 200 responses. ffuf -w hosts.txt -u https://example.org/ -H "Host: FUZZ" -mc 200 Fuzz POST JSON data. Match all responses not containing text "error". ffuf -w entries.txt -u https://example.org/ -X POST -H "Content-Type: application/json" \ -d '{"name": "FUZZ", "anotherkey": "anothervalue"}' -fr "error" Fuzz multiple locations. Match only responses reflecting the value of "VAL" keyword. Colored. ffuf -w params.txt:PARAM -w values.txt:VAL -u https://example.org/?PARAM=VAL -mr "VAL" -c More information and examples: https://github.com/ffuf/ffuf ```
## Scanning with Gobuster Scanning for virtual hosts in Gobuster is done with the **vhost** enumeration mode. You most probably want to use the IP address as the URL parameter. ```bash gobuster vhost -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt --append-domain -r -u http://thetoppers.htb ``` ### Usage information
gobuster -h ```bash ┌──(kali㉿kali)-[~/Desktop] └─$ gobuster -h Usage: gobuster [command] Available Commands: completion Generate the autocompletion script for the specified shell dir Uses directory/file enumeration mode dns Uses DNS subdomain enumeration mode fuzz Uses fuzzing mode. Replaces the keyword FUZZ in the URL, Headers and the request body gcs Uses gcs bucket enumeration mode help Help about any command s3 Uses aws bucket enumeration mode tftp Uses TFTP enumeration mode version shows the current version vhost Uses VHOST enumeration mode (you most probably want to use the IP address as the URL parameter) Flags: --debug Enable debug output --delay duration Time each thread waits between requests (e.g. 1500ms) -h, --help help for gobuster --no-color Disable color output --no-error Don't display errors -z, --no-progress Don't display progress -o, --output string Output file to write results to (defaults to stdout) -p, --pattern string File containing replacement patterns -q, --quiet Don't print the banner and other noise -t, --threads int Number of concurrent threads (default 10) -v, --verbose Verbose output (errors) -w, --wordlist string Path to the wordlist. Set to - to use STDIN. --wordlist-offset int Resume from a given position in the wordlist (defaults to 0) Use "gobuster [command] --help" for more information about a command. ```
gobuster vhost -h ```bash ┌──(kali㉿kali)-[~] └─$ gobuster vhost -h Uses VHOST enumeration mode (you most probably want to use the IP address as the URL parameter) Usage: gobuster vhost [flags] Flags: --append-domain Append main domain from URL to words from wordlist. Otherwise the fully qualified domains need to be specified in the wordlist. --client-cert-p12 string a p12 file to use for options TLS client certificates --client-cert-p12-password string the password to the p12 file --client-cert-pem string public key in PEM format for optional TLS client certificates --client-cert-pem-key string private key in PEM format for optional TLS client certificates (this key needs to have no password) -c, --cookies string Cookies to use for the requests --domain string the domain to append when using an IP address as URL. If left empty and you specify a domain based URL the hostname from the URL is extracted --exclude-length string exclude the following content lengths (completely ignores the status). You can separate multiple lengths by comma and it also supports ranges like 203-206 -r, --follow-redirect Follow redirects -H, --headers stringArray Specify HTTP headers, -H 'Header1: val1' -H 'Header2: val2' -h, --help help for vhost -m, --method string Use the following HTTP method (default "GET") --no-canonicalize-headers Do not canonicalize HTTP header names. If set header names are sent as is. -k, --no-tls-validation Skip TLS certificate verification -P, --password string Password for Basic Auth --proxy string Proxy to use for requests [http(s)://host:port] or [socks5://host:port] --random-agent Use a random User-Agent string --retry Should retry on request timeout --retry-attempts int Times to retry on request timeout (default 3) --timeout duration HTTP Timeout (default 10s) -u, --url string The target URL -a, --useragent string Set the User-Agent string (default "gobuster/3.6") -U, --username string Username for Basic Auth Global Flags: --debug Enable debug output --delay duration Time each thread waits between requests (e.g. 1500ms) --no-color Disable color output --no-error Don't display errors -z, --no-progress Don't display progress -o, --output string Output file to write results to (defaults to stdout) -p, --pattern string File containing replacement patterns -q, --quiet Don't print the banner and other noise -t, --threads int Number of concurrent threads (default 10) -v, --verbose Verbose output (errors) -w, --wordlist string Path to the wordlist. Set to - to use STDIN. --wordlist-offset int Resume from a given position in the wordlist (defaults to 0) ```
## Resources ffuf - GitHub: ffuf - Kali Tools: Gobuster - GitHub: Gobuster - Kali Tools: Virtual hosting - Wikipedia: