skills.rest
uphiago
uphiagoCOMMUNITY
Explore all skills by this author →
Website𝕏@uphiagoGitHub

vhost-enumeration

Fuzz Host headers and parse SSL certificate SANs to discover hidden virtual hosts.

1.1k|191|Updated Jun 24, 2026
Search Tags:#enumeration#vhost#ssl#fuzzing#pentest#recon#host-header
One-click install
npx skills add https://github.com/uphiago/recon-skills --skill vhost-enumeration
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: vhost-enumeration
Source: https://github.com/uphiago/recon-skills/tree/main/recon/vhost-enumeration
Command: npx skills add https://github.com/uphiago/recon-skills --skill vhost-enumeration

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Standard subdomain enumeration often misses internal-only, development, or admin virtual hosts that share an IP address with public services, as these hosts only respond to specific Host headers or are only listed in SSL certificate SAN fields, leaving them invisible to standard DNS-based reconnaissance techniques.

Core Features & Use Cases

  • Host Header Fuzzing: Brute-force valid virtual hostnames using ffuf with custom Host headers to identify hosts that return unique responses.
  • SSL Certificate SAN Extraction: Parse TLS certificates to extract all domain names associated with an IP address, revealing hidden services exposed via HTTPS.
  • PTR Reverse DNS Lookup: Resolve PTR records for IP ranges to discover hostnames associated with target network ranges.
  • Use Case: When assessing a company's public infrastructure, this skill can uncover unlisted staging environments or internal admin panels that are not present in public DNS records, expanding your reconnaissance coverage.

Quick Start

Use the vhost-enumeration skill to fuzz the Host header for target IP 203.0.113.10 with your DNS wordlist and extract all associated hostnames from its SSL certificate SAN field.

Frequently Asked Questions about vhost-enumeration

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find hidden virtual hosts on a shared IP address?▼

Vhost enumeration works by brute-forcing Host headers against a target IP using tools like ffuf, filtering unique HTTP responses, and extracting hostnames from SSL certificate SAN fields and PTR reverse DNS lookups.

Why does standard subdomain enumeration fail to find internal admin panels?▼

Standard subdomain enumeration misses internal admin panels because these services share an IP address and only respond to specific Host headers, requiring Host header brute-forcing and TLS certificate hostname extraction to uncover.

What is the best way to extract hostnames from an SSL certificate during pentest recon?▼

Extract hostnames from an SSL certificate via SAN parsing to reveal hidden HTTPS services. This uncovers internal-only or reverse-proxied virtual hosts sharing a single IP address that standard DNS reconnaissance fails to identify.

Can I use ffuf for virtual host fuzzing on target IP addresses?▼

Yes, ffuf supports virtual host fuzzing by brute-forcing custom Host headers against a target IP. This identifies valid virtual hostnames returning unique HTTP responses, revealing unlisted staging environments or admin panels.

When do I need PTR record reverse DNS lookups for vhost discovery?▼

Use PTR record reverse DNS lookups to resolve hostnames for target IP ranges, discovering associated virtual hosts. This uncovers hidden services sharing a single IP address that standard subdomain enumeration misses during reconnaissance.

Related Skills

Explore More Software Engineering Skills→
zebbernzebbern
4.5k

Shodan Reconnaissance and Pentesting

Query Shodan hosts, ports, banners, and vulnerabilities via CLI and API.

Community
Intermediate
Bsh13lderBsh13lder
4

web2-recon

Enumerate subdomains, verify live hosts, collect URLs, and scan for vulnerabilities.

Community
Intermediate
crazyMarkycrazyMarky
277

recon-subdomain

Enumerate subdomains and gather DNS records using subfinder, amass, and dnsx.

Community
Intermediate
L3DigitalNetL3DigitalNet
6

nmap

Scan networks for hosts, ports, services, and operating systems using nmap.

Official
Intermediate