Virtual Host Enumeration

Virtual host enumeration finds applications routed by hostname on the same IP. When a server returns different content depending on the Host header, there are likely multiple apps running — some not linked from the main site. Run this after tech fingerprinting confirms Host header sensitivity, or after subdomain bruteforce returns names resolving to the same IP.

Confirm Virtual Host Routing First

Before bruteforcing, verify the server responds differently to different Host headers:

Different response sizes confirm virtual host routing is active. If sizes match, the server either has no vhost routing or falls back to a default for unknown hosts — bruteforcing will still run but filter results need attention.

ffuf Virtual Host Bruteforce

ffuf injects wordlist entries into the Host header. The key is filtering out the default response size so you only see results that differ from the baseline:

Filter the default response size to remove noise. Measure it first, then add -fs:

Any result with a size different from the baseline is a valid virtual host. Add the discovered names to /etc/hosts and browse them directly:

gobuster vhost Mode

gobuster has a dedicated vhost mode that also measures response differences. Useful as a second pass when ffuf results look incomplete:

The --append-domain flag appends the base domain to each wordlist entry, producing dev.example.com rather than just dev. Required for most modern setups.

HTTPS Virtual Hosts

For HTTPS targets, add -k to skip certificate validation and specify the full HTTPS URL:

Non-Standard Ports

When the target runs on a non-standard port, specify it in both the URL and the Host header:

After discovering virtual hosts, run content discovery separately against each vhost — they often have completely different directory structures and applications.