Find Virtual Hosts
A single web server can be configured to run multiple websites at once, under different domain names. These are called virtual hosts (or vhosts) and they are usually found in shared hosting environments.
www.company1.com -> 18.104.22.168
test.company2.com -> 22.214.171.124
sales.company3.com -> 126.96.36.199
As a penetration tester, finding all the vhosts that run on a web server (based on its IP address) is important because each website may contain vulnerabilities that affect the same server. Furthermore, if one website is compromised, there is a high chance that the attacker gains unauthorized access to the other websites also that are running on the same server. Hence, testing all the vhosts is necessary for complete coverage of the penetration test.
|IP address or Hostname||This identifies the server on which you search for virtual hosts. If a hostname is given, DNS resolution will be attempted first to find its IP address.|
How it works
This tool uses multiple discovery techniques, such as:
- Searching in public search engines
- DNS resolutions
- Analyzing web redirects
- Searching in SSL certificates