← Back to Academy

Academy Node

Virtual Host Enumeration

VHost enumeration finds hostnames served by the same web server.

Beginner100 XPWeb

Why it matters

Hidden vhosts often expose admin panels, dev apps, staging portals, or source leaks.

How to identify it

  • Host header changes response
  • Certificate SANs
  • Redirects to domain

Linux commands

ffuf -u http://TARGET -H 'Host: FUZZ.domain.local' -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt -fs SIZE
gobuster vhost -u http://domain.local -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt --append-domain

Expected output

  • Different response size/status
  • New vhost

Success looks like

  • New app or admin area found

Failure looks like

  • No response variation

Troubleshooting

  • Find baseline size
  • Try HTTPS
  • Check cert SANs

Common mistakes

  • Not filtering by size
  • Not adding discovered names to /etc/hosts

Alternative attacks

  • Directory brute force

What to try next

  • Add vhost to /etc/hosts
  • Run web enum on new vhost

Recommended next lessons

ASREP Roast

ASREP roasting abuses AD users with Kerberos pre-authentication disabled. You can request encrypted ASREP material and attempt to crack it offline.

Kerberoast

Kerberoasting targets domain users with SPNs. You request service tickets and crack them offline.

GenericWrite

GenericWrite means you can modify certain attributes on the target AD object.

GenericAll

GenericAll is effectively full control over the target AD object.