Virtual Host (VHost) Fuzzing with ffuf

Virtual hosts allow multiple websites to run on the same IP address. The web server determines which site to serve based on the Host header.

ffuf -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt \
-u http://154.57.164.63:32605 \
-H "Host: FUZZ.inlanefreight.htb" \
-fs 10918

Explanation:

• w – Wordlist containing possible vhost names.
• u – Target URL or IP address.
• H "Host: FUZZ.inlanefreight.htb" – Replaces FUZZ with each word in the wordlist (e.g., admin.inlanefreight.htb, dev.inlanefreight.htb).
• fs 10918 – Filters out responses with a size of 10918 bytes (the default/invalid page), highlighting valid virtual hosts.

A valid vhost will typically return a different response size or status code, for example:

admin.inlanefreight.htb [Status: 200, Size: 100]

Gobuster Subdomain Fuzzing

Unlike virtual hosts, subdomains are DNS records that resolve to an IP address. Gobuster discovers them by querying DNS.

gobuster dns \
--domain inlanefreight.com \
-w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt

Explanation:

• dns – Enables DNS enumeration mode.
• -domain – Specifies the target domain.
• w – Wordlist containing common subdomain names.

Gobuster appends each word from the wordlist to the target domain and checks whether it resolves:

www.inlanefreight.com
admin.inlanefreight.com
blog.inlanefreight.com
support.inlanefreight.com