skills.rest
gongzeq
gongzeqCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

ffuf-vhost-fuzz

Fuzz Host headers to enumerate live virtual hosts behind a shared IP.

Updated May 7, 2026
Search Tags:#ffuf#fuzzing#security-testing#virtual-host#vhost-discovery#web-assessment
One-click install
npx skills add https://github.com/gongzeq/VAPT3 --skill ffuf-vhost-fuzz
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: ffuf-vhost-fuzz
Source: https://github.com/gongzeq/VAPT3/tree/main/secbot/skills/ffuf-vhost-fuzz
Command: npx skills add https://github.com/gongzeq/VAPT3 --skill ffuf-vhost-fuzz

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Enumerate live virtual hosts behind a shared IP by fuzzing the Host header to reveal responsive vhosts that differ in size or status.

Core Features & Use Cases

  • Two invocation modes: url + host_template and raw_request, enabling flexible vhost discovery across HTTP/S assets.
  • Auto-calibration and matching/filtering in ffuf to minimize false positives and surface live hosts with meaningful differences.
  • Output is a structured list of vhosts with host, url, status, length, words, lines, duration_ms, content_type, and redirect_location for easy ingestion into CMDB or reports.
  • Use Case: security assessments, asset discovery, and mapping virtual hosts for hardened per-host testing.

Quick Start

Run ffuf-vhost-fuzz against a target URL with a Host: FUZZ.example.com pattern and a wordlist to enumerate live virtual hosts.

Frequently Asked Questions about ffuf-vhost-fuzz

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I discover hidden virtual hosts on a shared IP address?▼

Virtual host discovery is performed by fuzzing the Host header against a target IP. This skill uses ffuf to enumerate responsive vhosts, revealing those that differ in response size or HTTP status code.

Can I use a raw HTTP request for vhost fuzzing instead of a URL?▼

Yes, vhost fuzzing accepts a full raw HTTP request as input. Alternatively, you can specify a target URL combined with a host template like FUZZ.example.com to enumerate virtual hosts.

What output format does ffuf vhost discovery return for asset mapping?▼

Vhost discovery returns a structured list containing host, url, status, length, words, lines, duration_ms, content_type, and redirect_location fields for easy ingestion into CMDB or security reports.

Does vhost fuzzing support auto-calibration to reduce false positives?▼

Yes, vhost fuzzing supports ffuf auto-calibration and matching filters. These features minimize false positives by surfacing only live hosts with meaningful differences in response size or status.

Do I need to install ffuf separately to enumerate virtual hosts?▼

Yes, ffuf must be installed to perform host header fuzzing. The skill utilizes configurable binary resolution to locate the ffuf executable and accepts a wordlist along with optional proxy settings.

Why should I fuzz the Host header instead of just scanning IP ports?▼

Host header fuzzing reveals multiple web applications hosted behind a single shared IP. Port scanning misses these distinct virtual hosts, making header fuzzing essential for thorough security assessments and asset discovery.

Related Skills

Explore More Software Engineering Skills→
MicrockMicrock
322

ffuf-web-fuzzing

Automate web content discovery by fuzzing targets with ffuf to reveal hidden resources.

Community
Advanced
gongzeqgongzeq

fscan-port-scan

Scan multiple hosts for open ports and services using fscan.

Community
Advanced
AeonDaveAeonDave
15

ffuf

Fuzz HTTP endpoints with wordlists to discover directories, parameters, and virtual hosts.

Community
Intermediate
riandeoliveirariandeoliveira

testing-for-host-header-injection

Detect HTTP Host header injection vulnerabilities during authorized security testing.

Community
Intermediate