Subdomain & vhost fuzzing
Last updated
Was this helpful?
Last updated
Was this helpful?
A web server can host multiple websites for multiple domain names (websites). In order to choose what website to show for what domain, many use what is called "virtual hosting". Virtual hosting can be based on a name, an IP, or a port ().
Two main mechanisms can be used to access a website on a virtual host:
HTTP: the use of the Host request header. The client uses the <host> directive to connect to the domain name of the server. Optionally, it can use the <port> directive to specify a TCP port number on which the server is listening.
HTTPS: the use of the Server Name Indication (SNI) extension with TLS. The client indicates the hostname it wants to connect to at the start of the handshake process.
When having a domain name as scope, operating virtual host (a.k.a. vhost) fuzzing is recommended to possibly find alternate domain names of subdomains that point to a virtual host, and thus have a better knowledge of the attack surface. This technique relies on the attacker using a dictionary/wordlist. A request is made for every line of the wordlist to differentiate pages that exist and pages that don't
This technique is not to be confused with . Vhost fuzzing/bruteforcing requests are made over HTTP and rely on the virtual hosting feature that many web app profit from. relies on domain name resolution requests made over DNS to a DNS server.
Tools like (Go), (Python) and (Go) can do vhost fuzzing/bruteforcing. Burp Suite can do it too. Depending on the web application, one will be better suited than another and additional options will be needed.
Vhost fuzzing needs to be slowed down when testing production instances as it could lead to an unintended denial of service.
Some applications don't allow vhost fuzzing like showcased above. The command below can be attempted.
Virtual host fuzzing is not the only technique to find subdomains. There are others means to that end: see .
