Recon
Find hostnames one IP answers for
Virtual host scanner with Host-header sweeps and catch-all detection.
overview
What vhostscan does
vhostscan connects to a target with -t and sweeps candidate hostnames from -w through the Host header. Use -b as the base domain for wordlist substitution when the IP differs from the name you care about. Optional --ssl and -p cover HTTPS and non-default ports.
Catch-all servers return a default page for every name. Enable --fuzzy-logic so response bodies are compared and scored for similarity; real vhosts stand out even when the default page changes per request. --waf, --prefix, and --suffix help when naming conventions or filters get in the way.
Run after you have an IP with -t and a base domain with -b, sweep -w, then probe discovered hosts with httpx. Prefer vhostscan when names never appear in DNS. Use ffuf virtual-host mode for faster fuzzing without --fuzzy-logic; use gobuster-dns or subfinder for DNS-side names.
source github.com/codingo/VHostScan
use cases
Where vhostscan fits
Enumerate hidden vhosts on one IP
Sweep a hostname wordlist through the Host header against a target IP to surface staging, admin, and legacy sites sharing the same server.
Beat catch-all default pages
Enable --fuzzy-logic so vhostscan compares response content and scores similarity, isolating real vhosts even when the default page changes per request.
Pivot through a forwarded port
Set -r so headers carry the true webserver port while you scan through an SSH or netcat tunnel on a different local port.
Expand the wordlist with affixes
Add --prefix or --suffix values like dev- and -staging to each wordlist entry to catch naming conventions without editing the list itself.
reference
vhostscan inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| target-hosts | STRING | -t | Set the target host. |
| wordlists | FILE | -w | Wordlist(s) to use; comma-delimited for multiple. |
| base-host | STRING | -b | Host used during substitution in the wordlist (default TARGET). |
| port | STRING | -p | Port to use (default 80). |
| ssl | BOOLEAN | --ssl | Make connections over HTTPS instead of HTTP. |
| fuzzy-logic | BOOLEAN | --fuzzy-logic | Compare unique content replies and score similarity to isolate vhosts. |
| waf | BOOLEAN | --waf | Send simple WAF bypass headers. |
| ignore-http-codes | STRING | --ignore-http-codes | Comma-separated HTTP codes to ignore (default 404). |
Showing key inputs. vhostscan exposes 17 inputs in total.
Full flag reference (17 inputs)
| Name | Type | Flag | Description |
|---|---|---|---|
| ssl | BOOLEAN | --ssl | If set then connections will be made over HTTPS instead of HTTP. |
| waf | BOOLEAN | --waf | If set then simple WAF bypass headers will be sent. |
| port | STRING | -p | Set the port to use (default 80). |
| base-host | STRING | -b | Set host to be used during substitution in wordlist (default to TARGET). |
| real-port | STRING | -r | The real port of the webserver to use in headers when not 80 (see RFC2616 14.23), useful when pivoting through ssh/nc etc (default to PORT). |
| wordlists | FILE | -w | Set the wordlist(s) to use. You may specify multiple wordlists in comma delimited format (e.g. -w "./wordlists/simple.txt, ./wordlists/hackthebox.txt" (default ./wordlists/virtual-host-scanning.txt). |
| user-agent | STRING | --user-agent | Specify a user agent to use for scans. |
| fuzzy-logic | BOOLEAN | --fuzzy-logic | If set then all unique content replies are compared and a similarity ratio is given for each pair. This helps to isolate vhosts in situations where a default page isn't static (such as having the time on it). |
| random-agent | BOOLEAN | --random-agent | If set, each scan will use a random user-agent from a predefined list. |
| target-hosts | STRING | -t | Set the target host. |
| ignore-http-codes | STRING | --ignore-http-codes | Comma separated list of http codes to ignore with virtual host scans (default 404). |
| ignore-content-length | STRING | --ignore-content-length | Ignore content lengths of specificed amount. |
| Delay-between-each-scan | STRING | --rate-limit | Amount of time in seconds to delay between each scan (default 0). |
| Disable-reverse-lookups | BOOLEAN | --no-lookups | Disbale reverse lookups (identifies new targets and append to wordlist, on by default). |
| First-successful-result | BOOLEAN | --first-hit | Return first successful result. Only use in scenarios where you are sure no catch-all is configured (such as a CTF). |
| Suffix-to-items-in-wordlist | STRING | --suffix | Add a suffix to each item in the wordlist, to add <word>dev, <word>dev |
| Prefix-to-items-in-wordlists | STRING | --prefix | Add a prefix to each item in the wordlist, to add dev-<word>, test-<word> etc |
example
Run vhostscan
# sweep vhosts over HTTPS with fuzzy catch-all detectionvhostscan -t 198.51.100.24 -b example.com -w vhosts.txt -p 443 --ssl --fuzzy-logic[+] Starting virtual host scan for 198.51.100.24 using port 443 and ssl[+] Using base host example.com for wordlist substitution[+] www.example.com[+] admin.example.com[+] staging.example.com[+] api.example.com[+] dev.example.com[+] mail.example.com[+] vpn.example.comguidance
Choosing vhostscan
Use vhostscan when one IP serves multiple sites and the hostnames are missing from DNS. --fuzzy-logic handles catch-all defaults that defeat simpler scanners. For directory brute forcing, use gobuster or ffuf; for DNS names, use subfinder or gobuster-dns.
ffuf-virtual-hosts
Fast vhost fuzzing with ffuf. vhostscan adds fuzzy catch-all detection and base-host substitution.
gobuster-dns
Brute forces DNS subdomains. vhostscan finds vhosts on one IP via the Host header instead.
subfinder
Passive subdomain discovery. vhostscan finds names a single server answers for, not DNS records.
faq
vhostscan questions
related
More Recon tools
amass
Multi-source subdomain discovery; hand names to httpx.
amass-intel
OWASP Amass intel: map an organization's root domains and ranges.
assetfinder
Find domains and subdomains potentially related to a given domain.
bbot
Modular OSINT recon that chains modules from a seed target.
bevigil
CLI client for the BeVigil OSINT API, keyed by domain or app package.
cloud-enum
Multi-cloud public name enumeration for AWS, Azure, and GCP.
Run vhostscan yourself
A target host and a hostname wordlist feed vhostscan, which sweeps the Host header and writes the discovered virtual hosts as a queryable output.
Facts on this page come from the live Trickest tool library.