{"id":4823,"date":"2017-10-08T23:11:54","date_gmt":"2017-10-08T15:11:54","guid":{"rendered":"https:\/\/www.darknet.org.uk\/?p=4823"},"modified":"2017-10-08T23:12:15","modified_gmt":"2017-10-08T15:12:15","slug":"vhostscan-virtual-host-scanner-with-alias-catch-all-detection","status":"publish","type":"post","link":"https:\/\/www.darknet.org.uk\/2017\/10\/vhostscan-virtual-host-scanner-with-alias-catch-all-detection\/","title":{"rendered":"VHostScan &#8211; Virtual Host Scanner With Alias &#038; Catch-All Detection"},"content":{"rendered":"<p>VHostScan is a Python-based virtual host scanner that can be used with pivot tools, detect catch-all scenarios, aliases and dynamic default pages.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/www.darknet.org.uk\/wp-content\/uploads\/2017\/10\/VHostScan-Virtual-Host-Scanner-With-Alias-Catch-All-Detection-640x441.png\" alt=\"VHostScan - Virtual Host Scanner With Alias &amp; Catch-All Detection\" width=\"640\" height=\"441\" class=\"aligncenter size-medium wp-image-4824\" srcset=\"https:\/\/www.darknet.org.uk\/wp-content\/uploads\/2017\/10\/VHostScan-Virtual-Host-Scanner-With-Alias-Catch-All-Detection-640x441.png 640w, https:\/\/www.darknet.org.uk\/wp-content\/uploads\/2017\/10\/VHostScan-Virtual-Host-Scanner-With-Alias-Catch-All-Detection-1024x706.png 1024w, https:\/\/www.darknet.org.uk\/wp-content\/uploads\/2017\/10\/VHostScan-Virtual-Host-Scanner-With-Alias-Catch-All-Detection.png 1399w\" sizes=\"(max-width: 640px) 100vw, 640px\" \/><\/p>\n<script async src=\"https:\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-3033787195489589\"\r\n     crossorigin=\"anonymous\"><\/script>\r\n<!-- Darknet Responsive Post Ad Links [previously link ad unit] -->\r\n<ins class=\"adsbygoogle\"\r\n     style=\"display:block\"\r\n     data-ad-client=\"ca-pub-3033787195489589\"\r\n     data-ad-slot=\"5456620019\"\r\n     data-ad-format=\"auto\"><\/ins>\r\n<script>\r\n     (adsbygoogle = window.adsbygoogle || []).push({});\r\n<\/script>\n<h2>Features of VHostScan Virtual Host Scanner<\/h2>\n<ul>\n<li>Quickly highlight unique content in catch-all scenarios<\/li>\n<li>Locate the outliers in catch-all scenarios where results have dynamic content on the page (such as the time)<\/li>\n<li>Identify aliases by tweaking the unique depth of matches<\/li>\n<li>Wordlist supports standard words and a variable to input a base hostname (for e.g. dev.%s from the wordlist would be run as dev.BASE_HOST)<\/li>\n<li>Work over HTTP and HTTPS<\/li>\n<li>Ability to set the real port of the webserver to use in headers when pivoting through ssh\/nc<\/li>\n<li>Add simple response headers to bypass some WAF products<\/li>\n<li>Identify new targets by using reverse lookups and append to wordlist<\/li>\n<\/ul>\n<h3>Usage &#8211; Using VHostScan<\/h3>\n<pre>-h, --help\tDisplay help message and exit\r\n-t TARGET_HOSTS\tSet the target host.\r\n-b BASE_HOST\tSet host to be used during substitution in wordlist (default to TARGET).\r\n-w WORDLISTS\tSet the wordlist(s) to use. You may specify multiple wordlists in comma delimited format (e.g. -w \".\/wordlists\/simple.txt, .\/wordlists\/hackthebox.txt\" (default .\/wordlists\/virtual-host-scanning.txt).\r\n-p PORT\tSet the port to use (default 80).\r\n-r REAL_PORT\tThe real port of the web server to use in headers when not 80 (see RFC2616 14.23), useful when pivoting through ssh\/nc etc (default to PORT).\r\n--ignore-http-codes IGNORE_HTTP_CODES\tComma-separated list of HTTP codes to ignore with virtual host scans (default 404).\r\n--ignore-content-length IGNORE_CONTENT_LENGTH\tIgnore content lengths of specified amount.\r\n--unique-depth UNIQUE_DEPTH\tShow likely matches of page content that is found x times (default 1).\r\n--ssl\tIf set then connections will be made over HTTPS instead of HTTP.\r\n--fuzzy-logic\tIf set then all unique content replies are compared and a similarity ratio is given for each pair. This helps to isolate vhosts in situations where a default page isn't static (such as having the time on it).\r\n--no-lookups\tDisbale reverse lookups (identifies new targets and append to wordlist, on by default).\r\n--rate-limit\tAmount of time in seconds to delay between each scan (default 0).\r\n--random-agent\tIf set, each scan will use a random user-agent from a predefined list.\r\n--user-agent\tSpecify a user agent to use for scans.\r\n--waf\tIf set then simple WAF bypass headers will be sent.\r\n-oN OUTPUT_NORMAL\tNormal output printed to a file when the -oN option is specified with a filename argument.\r\n-oJ OUTPUT_JSON\tJSON output printed to a file when the -oJ option is specified with a filename argument.\r\n-\tBy passing a blank '-' you tell VHostScan to expect input from stdin (pipe).<\/pre>\n<p>Another similar tool would be <a href=\"https:\/\/www.darknet.org.uk\/2009\/12\/hostmap-0-2-automatic-hostname-virtual-hosts-discovery-tool\/\">hostmap 0.2 \u2013 Automatic Hostname &#038; Virtual Hosts Discovery Tool<\/a>.<\/p>\n<p>You can download VHostScan here:<\/p>\n<p><a href=\"https:\/\/github.com\/codingo\/VHostScan\/archive\/1.5.4.zip\">VHostSca-1.5.4.zip<\/a><\/p>\n<p>Or read more <a href=\"https:\/\/github.com\/codingo\/VHostScan\">here<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>VHostScan is a Python-based virtual host scanner that can be used with pivot tools, detect catch-all scenarios, aliases and dynamic default pages. Features of VHostScan Virtual Host Scanner Quickly highlight unique content in catch-all scenarios Locate the outliers in catch-all scenarios where results have dynamic content on the page (such as the time) Identify aliases [&hellip;]<\/p>\n","protected":false},"author":25,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_seopress_robots_primary_cat":"","_seopress_titles_title":"","_seopress_titles_desc":"VHostScan is a Python-based virtual host scanner that can be used with pivot tools, detect catch-all scenarios, aliases and dynamic default pages.","_seopress_robots_index":"","_genesis_hide_title":false,"_genesis_hide_breadcrumbs":false,"_genesis_hide_singular_image":false,"_genesis_hide_footer_widgets":false,"_genesis_custom_body_class":"","_genesis_custom_post_class":"","_genesis_layout":"","footnotes":""},"categories":[9],"tags":[284],"featured_image_src":null,"featured_image_src_square":null,"author_info":{"display_name":"Darknet","author_link":"https:\/\/www.darknet.org.uk\/author\/darknet\/"},"_links":{"self":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts\/4823"}],"collection":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/users\/25"}],"replies":[{"embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/comments?post=4823"}],"version-history":[{"count":0,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts\/4823\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/media?parent=4823"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/categories?post=4823"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/tags?post=4823"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}