Menu
Discover hidden virtual hosts via Host header fuzzing and SSL certificate parsing.
The review-first prompt is selected by default. You can switch to a direct command or download a local copy.
Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
npx skills add https://github.com/uphiago/recon-skills --skill vhost-enumerationThe command stays on one line. Scroll horizontally to inspect it before copying.
Prefer a local copy? Download the files currently available to SkillsMP.
Full WSTG-aligned web application pentest — 12-phase methodology from information gathering through reporting, with concrete commands, expected outputs, pitfalls, and verification per phase.
Attack SAML SSO via XSW, signature strip, metadata extract.
Use when two or more verified findings may combine into a higher-impact authorized attack path.
Based on SOC occupation classification
Showing SKILL.md
| name | vhost-enumeration |
| description | Discover hidden virtual hosts via Host header fuzzing and SSL certificate parsing. |
| version | 1.1.0 |
| revision_date | "2026-07-25T00:00:00.000Z" |
| license | MIT |
| platforms | ["linux"] |
| compatibility | Requires curl, ffuf, dnsx |
| tags | ["recon","vhost","virtual-host","Host-header","fuzzing","SSL","PTR"] |
| category | recon |
| related_skills | ["subdomain-enumeration","origin-ip-discovery","web-enumeration"] |
Discover hidden virtual hosts on IP addresses by fuzzing the Host header. Many servers only respond to specific domain names and remain invisible to standard subdomain enumeration. VHOST fuzzing exposes internal services, development environments, and admin panels that share the same IP but answer to different hostnames.
skill_view(name='origin-ip-discovery') or skill_view(name='port-service-discovery').terminal with curl, ffuf, dnsx, and httpx.# Basic VHOST fuzz on a single IP
ffuf -u http://TARGET_IP \
-w /path/to/wordlist.txt \
-H "Host: FUZZ.target.com" \
-fs 0 -mc 200,301,302,401,403
# Fuzz for virtual hosts matching the target domain pattern
ffuf -u http://TARGET_IP \
-w $DNS_WORDLIST \
-H "Host: FUZZ.target.com" \
-fs DEFAULT_RESPONSE_SIZE \
-mc 200,301,302,401,403 \
-o vhost_ffuf.json
# HTTPS variant
ffuf -u https://target.com \
-w $DNS_WORDLIST \
-H "Host: FUZZ.target.com" \
-mc 200,301,302,401,403
# Fuzz multiple IPs with a wordlist
cat unique_ips.txt | while read ip; do
ffuf -u "http://$ip" \
-w $DNS_WORDLIST \
-H "Host: FUZZ.target.com" \
-fs 0 -mc 200,301,302 -o "vhost_$ip.json"
sleep 0.5
done
# Auto-calibrate: ffuf detects default response size and filters it out
ffuf -u http://TARGET_IP \
-w $DNS_WORDLIST \
-H "Host: FUZZ.target.com" \
-ac -sf -s \
-mc 200
# Manual calibration: find the default response size first
curl --max-time 30 --connect-timeout 10 -s http://TARGET_IP -H "Host: nonexistentxxxxx12345.target.com" | wc -c
# Use that size as -fs filter
# Method 1 — direct curl with Host header
curl --max-time 30 --connect-timeout 10 -H "Host: dev.target.com" http://TARGET_IP
# Method 2 — /etc/hosts injection for browser access
echo "TARGET_IP dev.target.com internal.target.com admin.target.com" | sudo tee -a /etc/hosts
# Then open http://dev.target.com in browser
# Method 3 — httpx with custom host resolution
echo "http://dev.target.com" | httpx -silent
# Extract hostnames from SSL certificate
echo | openssl s_client -connect TARGET_IP:443 -servername target.com 2>/dev/null \
| openssl x509 -noout -text \
| grep -Eo 'DNS:[^,\s]+' | cut -d: -f2 | sort -u
# Batch: extract hostnames from all discovered IPs
cat unique_ips.txt | while read ip; do
echo | timeout 5 openssl s_client -connect $ip:443 2>/dev/null \
| openssl x509 -noout -text 2>/dev/null \
| grep -Eo 'DNS:[^,\s]+' | cut -d: -f2 | sort -u >> ssl_hostnames.txt
sleep 0.5
done
# Check which of those hostnames resolve to the target
cat ssl_hostnames.txt | dnsx -silent -a -resp-only | sort -u
# If you have IP ranges, resolve PTR records to find hostnames
echo "10.0.0.0/23" | dnsx -silent -resp-only -ptr
# Batch on multiple CIDR ranges
cat cidr_ranges.txt | mapcidr -silent | dnsx -ptr -resp-only -silent > ptr_domains.txt
# For each found VHOST, take a screenshot for visual triage
cat found_vhosts.txt | gowitness file -f - --no-http -P ./vhost_screenshots/
# Compare content across hosts — different content = different service
for host in $(cat found_vhosts.txt); do
curl --max-time 30 --connect-timeout 10 -sk "http://TARGET_IP" -H "Host: $host" | md5sum
sleep 0.3
done | sort
-ac) and verify manually.-fs with a known-nonexistent hostname.openssl s_client -servername for each hostname.subdomain-enumeration — Generate the DNS wordlist and existing subdomains.origin-ip-discovery — Find the origin IPs that need VHOST scanning.web-enumeration — Once VHOSTs are found, fuzz directories and endpoints.