Gobuster Section 3 of 13

Virtual Host Bruteforce

The vhost mode tests different Host HTTP headers against a target IP to discover virtual hosts configured on shared hosting, load balancers, and reverse proxies.

What are Virtual Hosts

Virtual hosting allows multiple websites to share a single IP address. The web server (Apache, Nginx, etc.) decides which site to serve based on the Host header in the HTTP request. When you visit example.com, your browser sends Host: example.com. If you send Host: admin.example.com to the same IP, you might get a completely different website.

This is extremely common in cloud environments, shared hosting, and CDNs. A single load balancer might route traffic for dozens of different domains and subdomains. Virtual host enumeration helps you discover these hidden websites that share the same infrastructure.

How Vhost Scanning Works

Target IP

You specify the IP address (not the domain name) as the target. Gobuster sends HTTP requests directly to this IP.

Host Header Rotation

For each word in the wordlist, Gobuster sends an HTTP request with Host: word.target.com

Response Comparison

Gobuster compares the response to a baseline request. Different responses indicate a different virtual host.

Result Filtering

Responses matching the baseline are filtered out. Unique responses are reported as discovered virtual hosts.

Vhost Scanning Commands

Basic Virtual Host Scan

bash

1gobuster vhost -u http://10.0.0.1/ -w /usr/share/wordlists/vhosts.txt

Tests each word from vhosts.txt as a Host header against 10.0.0.1.

With Automatic Domain Appending

bash

1gobuster vhost -u http://10.0.0.1/ -w /usr/share/wordlists/common.txt --append-domain -d example.com

The --append-domain flag adds .example.com to each wordlist entry automatically.

Higher Thread Count

bash

1gobuster vhost -u http://10.0.0.1/ -w vhosts.txt -t 50

Increases parallelism for faster scanning against responsive targets.

Save Results

bash

1gobuster vhost -u http://10.0.0.1/ -w vhosts.txt -o vhosts-found.txt

Saves discovered virtual hosts to a file for further investigation.

Tips & Considerations

Tip

Always use --append-domain when your wordlist contains bare words like "admin", "api", "dev". Without it, Gobuster sends Host: admin which is usually wrong.

Warning

Some CDNs and WAFs return the same response for every Host header. If all responses look identical, the target may not use virtual hosting or may be using a CDN that ignores the Host header.

Info

Combine vhost scanning with DNS enumeration. First find subdomains with gobuster dns, then verify they resolve to the same IP and test with gobuster vhost.

Next: S3 Buckets Back