ffuf-vhost-fuzz

Fuzz Host headers to enumerate live virtual hosts behind a shared IP.

Updated May 7, 2026

Search Tags:#ffuf #fuzzing #security-testing #virtual-host #vhost-discovery #web-assessment

Ready to run

npx skills add https://github.com/gongzeq/VAPT3 --skill ffuf-vhost-fuzz

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: ffuf-vhost-fuzz
Source: https://github.com/gongzeq/VAPT3/tree/main/secbot/skills/ffuf-vhost-fuzz
Command: npx skills add https://github.com/gongzeq/VAPT3 --skill ffuf-vhost-fuzz

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Enumerate live virtual hosts behind a shared IP by fuzzing the Host header to reveal responsive vhosts that differ in size or status.

Core Features & Use Cases

Two invocation modes: url + host_template and raw_request, enabling flexible vhost discovery across HTTP/S assets.
Auto-calibration and matching/filtering in ffuf to minimize false positives and surface live hosts with meaningful differences.
Output is a structured list of vhosts with host, url, status, length, words, lines, duration_ms, content_type, and redirect_location for easy ingestion into CMDB or reports.
Use Case: security assessments, asset discovery, and mapping virtual hosts for hardened per-host testing.

Quick Start

Run ffuf-vhost-fuzz against a target URL with a Host: FUZZ.example.com pattern and a wordlist to enumerate live virtual hosts.

Frequently Asked Questions about ffuf-vhost-fuzz

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I discover hidden virtual hosts on a shared IP address?▼

Virtual host discovery is performed by fuzzing the Host header against a target IP. This skill uses ffuf to enumerate responsive vhosts, revealing those that differ in response size or HTTP status code.

Can I use a raw HTTP request for vhost fuzzing instead of a URL?▼

Yes, vhost fuzzing accepts a full raw HTTP request as input. Alternatively, you can specify a target URL combined with a host template like FUZZ.example.com to enumerate virtual hosts.

What output format does ffuf vhost discovery return for asset mapping?▼

Vhost discovery returns a structured list containing host, url, status, length, words, lines, duration_ms, content_type, and redirect_location fields for easy ingestion into CMDB or security reports.

Does vhost fuzzing support auto-calibration to reduce false positives?▼

Yes, vhost fuzzing supports ffuf auto-calibration and matching filters. These features minimize false positives by surfacing only live hosts with meaningful differences in response size or status.

Do I need to install ffuf separately to enumerate virtual hosts?▼

Yes, ffuf must be installed to perform host header fuzzing. The skill utilizes configurable binary resolution to locate the ffuf executable and accepts a wordlist along with optional proxy settings.

Why should I fuzz the Host header instead of just scanning IP ports?▼

Host header fuzzing reveals multiple web applications hosted behind a single shared IP. Port scanning misses these distinct virtual hosts, making header fuzzing essential for thorough security assessments and asset discovery.