用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/uphiago/recon-skills --skill vhost-enumeration命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
基于 SOC 职业分类
正在显示 SKILL.md
| name | vhost-enumeration |
| description | Discover hidden virtual hosts via Host header fuzzing and SSL certificate parsing. |
| version | 1.1.0 |
| revision_date | "2026-07-25T00:00:00.000Z" |
| license | MIT |
| platforms | ["linux"] |
| compatibility | Requires curl, ffuf, dnsx |
| tags | ["recon","vhost","virtual-host","Host-header","fuzzing","SSL","PTR"] |
| category | recon |
| related_skills | ["subdomain-enumeration","origin-ip-discovery","web-enumeration"] |
Discover hidden virtual hosts on IP addresses by fuzzing the Host header. Many servers only respond to specific domain names and remain invisible to standard subdomain enumeration. VHOST fuzzing exposes internal services, development environments, and admin panels that share the same IP but answer to different hostnames.
skill_view(name='origin-ip-discovery') or skill_view(name='port-service-discovery').terminal with curl, ffuf, dnsx, and httpx.# Basic VHOST fuzz on a single IP
ffuf -u http://TARGET_IP \
-w /path/to/wordlist.txt \
-H "Host: FUZZ.target.com" \
-fs 0 -mc 200,301,302,401,403
# Fuzz for virtual hosts matching the target domain pattern
ffuf -u http://TARGET_IP \
-w $DNS_WORDLIST \
-H "Host: FUZZ.target.com" \
-fs DEFAULT_RESPONSE_SIZE \
-mc 200,301,302,401,403 \
-o vhost_ffuf.json
# HTTPS variant
ffuf -u https://target.com \
-w $DNS_WORDLIST \
-H "Host: FUZZ.target.com" \
-mc 200,301,302,401,403
# Fuzz multiple IPs with a wordlist
cat unique_ips.txt | while read ip; do
ffuf -u "http://$ip" \
-w $DNS_WORDLIST \
-H "Host: FUZZ.target.com" \
-fs 0 -mc 200,301,302 -o "vhost_$ip.json"
sleep 0.5
done
# Auto-calibrate: ffuf detects default response size and filters it out
ffuf -u http://TARGET_IP \
-w $DNS_WORDLIST \
-H "Host: FUZZ.target.com" \
-ac -sf -s \
-mc 200
# Manual calibration: find the default response size first
curl --max-time 30 --connect-timeout 10 -s http://TARGET_IP -H "Host: nonexistentxxxxx12345.target.com" | wc -c
# Use that size as -fs filter
# Method 1 — direct curl with Host header
curl --max-time 30 --connect-timeout 10 -H "Host: dev.target.com" http://TARGET_IP
# Method 2 — /etc/hosts injection for browser access
echo "TARGET_IP dev.target.com internal.target.com admin.target.com" | sudo tee -a /etc/hosts
# Then open http://dev.target.com in browser
# Method 3 — httpx with custom host resolution
echo "http://dev.target.com" | httpx -silent
# Extract hostnames from SSL certificate
echo | openssl s_client -connect TARGET_IP:443 -servername target.com 2>/dev/null \
| openssl x509 -noout -text \
| grep -Eo 'DNS:[^,\s]+' | cut -d: -f2 | sort -u
# Batch: extract hostnames from all discovered IPs
cat unique_ips.txt | while read ip; do
echo | timeout 5 openssl s_client -connect $ip:443 2>/dev/null \
| openssl x509 -noout -text 2>/dev/null \
| grep -Eo 'DNS:[^,\s]+' | cut -d: -f2 | sort -u >> ssl_hostnames.txt
sleep 0.5
done
# Check which of those hostnames resolve to the target
cat ssl_hostnames.txt | dnsx -silent -a -resp-only | sort -u
# If you have IP ranges, resolve PTR records to find hostnames
echo "10.0.0.0/23" | dnsx -silent -resp-only -ptr
# Batch on multiple CIDR ranges
cat cidr_ranges.txt | mapcidr -silent | dnsx -ptr -resp-only -silent > ptr_domains.txt
# For each found VHOST, take a screenshot for visual triage
cat found_vhosts.txt | gowitness file -f - --no-http -P ./vhost_screenshots/
# Compare content across hosts — different content = different service
for host in $(cat found_vhosts.txt); do
curl --max-time 30 --connect-timeout 10 -sk "http://TARGET_IP" -H "Host: $host" | md5sum
sleep 0.3
done | sort
-ac) and verify manually.-fs with a known-nonexistent hostname.openssl s_client -servername for each hostname.subdomain-enumeration — Generate the DNS wordlist and existing subdomains.origin-ip-discovery — Find the origin IPs that need VHOST scanning.web-enumeration — Once VHOSTs are found, fuzz directories and endpoints.