VHostScan is a Python-based virtual host scanner that can be used with pivot tools, detect catch-all scenarios, aliases and dynamic default pages.
Features of VHostScan Virtual Host Scanner
- Quickly highlight unique content in catch-all scenarios
- Locate the outliers in catch-all scenarios where results have dynamic content on the page (such as the time)
- Identify aliases by tweaking the unique depth of matches
- Wordlist supports standard words and a variable to input a base hostname (for e.g. dev.%s from the wordlist would be run as dev.BASE_HOST)
- Work over HTTP and HTTPS
- Ability to set the real port of the webserver to use in headers when pivoting through ssh/nc
- Add simple response headers to bypass some WAF products
- Identify new targets by using reverse lookups and append to wordlist
Usage – Using VHostScan
-h, --help Display help message and exit
-t TARGET_HOSTS Set the target host.
-b BASE_HOST Set host to be used during substitution in wordlist (default to TARGET).
-w WORDLISTS Set the wordlist(s) to use. You may specify multiple wordlists in comma delimited format (e.g. -w "./wordlists/simple.txt, ./wordlists/hackthebox.txt" (default ./wordlists/virtual-host-scanning.txt).
-p PORT Set the port to use (default 80).
-r REAL_PORT The real port of the web server to use in headers when not 80 (see RFC2616 14.23), useful when pivoting through ssh/nc etc (default to PORT).
--ignore-http-codes IGNORE_HTTP_CODES Comma-separated list of HTTP codes to ignore with virtual host scans (default 404).
--ignore-content-length IGNORE_CONTENT_LENGTH Ignore content lengths of specified amount.
--unique-depth UNIQUE_DEPTH Show likely matches of page content that is found x times (default 1).
--ssl If set then connections will be made over HTTPS instead of HTTP.
--fuzzy-logic If set then all unique content replies are compared and a similarity ratio is given for each pair. This helps to isolate vhosts in situations where a default page isn't static (such as having the time on it).
--no-lookups Disbale reverse lookups (identifies new targets and append to wordlist, on by default).
--rate-limit Amount of time in seconds to delay between each scan (default 0).
--random-agent If set, each scan will use a random user-agent from a predefined list.
--user-agent Specify a user agent to use for scans.
--waf If set then simple WAF bypass headers will be sent.
-oN OUTPUT_NORMAL Normal output printed to a file when the -oN option is specified with a filename argument.
-oJ OUTPUT_JSON JSON output printed to a file when the -oJ option is specified with a filename argument.
- By passing a blank '-' you tell VHostScan to expect input from stdin (pipe).
Another similar tool would be hostmap 0.2 – Automatic Hostname & Virtual Hosts Discovery Tool.
You can download VHostScan here:
Or read more here.