0xoscp-companion
← Back to search

Subdomain and Vhost Enumeration

reconchecklist

Summary

Fuzz Host headers to find virtual hosts and subdomains.

Walkthrough

Fuzz Host headers to discover subdomains or virtual hosts served by the same IP. A hit is a vhost that returns a different site, status code, or content length than the default IP response.

Commands

bash

wfuzz -u http://<IP> -H "Host: FUZZ.<DOMAIN>" -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt