+- Sinisterly (https://sinister.li)
+-- Forum: Hacking (https://sinister.li/Forum-Hacking)
+--- Forum: Hacking Tools (https://sinister.li/Forum-Hacking-Tools)
+--- Thread: VHostScan (/Thread-VHostScan)
VHostScan - ZanGetsu - 10-05-2017
A virtual host scanner that can be used with pivot tools, detect catch-all scenarios, aliases and dynamic default pages. First presented at SecTalks BNE in September 2017
- Quickly highlight unique content in catch-all scenarios
- Locate the outliers in catch-all scenarios where results have dynamic content on the page (such as the time)
- Identify aliases by tweaking the unique depth of matches
- Wordlist supports standard words and a variable to input a base hostname (for e.g. dev.%s from the wordlist would be run as dev.BASE_HOST)
- Work over HTTP and HTTPS
- Ability to set the real port of the webserver to use in headers when pivoting through ssh/nc
- Add simple response headers to bypass some WAF products
- Identify new targets by using reverse lookups and append to wordlist
Product Comparisons:
![[Image: featureMap.PNG]](https://github.com/codingo/codingo.github.io/raw/master/assets/featureMap.PNG)
Usage Examples:
Code:
$ VHostScan.py -t example.com![[Image: Bank%20VHOST%20Example.png]](https://github.com/codingo/codingo.github.io/raw/master/assets/Bank%20VHOST%20Example.png)
Port forwarding
Say you have an SSH port forward listening on port 4444 fowarding traffic to port 80 on example.com's development machine. You could use the following to make VHostScan connect through your SSH tunnel via localhost:4444 but format the header requests to suit connecting straight to port 80:
Code:
$ VHostScan.py -t localhost -b example.com -p 4444 -r 80STDIN
If you want to pipe information into VHostScan you can use the - flag:
Code:
$ cat bank.htb | VHostScan.py -t 10.10.10.29 -![[Image: Bank%20VHOST%20Pipe%20Example.png]](https://github.com/codingo/codingo.github.io/raw/master/assets/Bank%20VHOST%20Pipe%20Example.png)