domains / families / security / vhost-enumeration

vhost-enumeration

separate

Discover hidden virtual hosts via Host header fuzzing and SSL certificate parsing.

When to use

• You have a list of target IPs from `skill_view(name='origin-ip-discovery')` or `skill_view(name='port-service-discovery')`.
• A server returns default/blank pages for unknown Host headers.
• Subdomain enumeration may have missed internal-only hostnames.
• SSL certificates on an IP list multiple domain names in the SAN field.
• You need to map internal services behind a reverse proxy.

When not to use

• Standard subdomain enumeration
• Directory fuzzing
• Endpoint fuzzing

Skill page

Source