Find virtual hosts hidden behind shared IPs

Aug 14, 2026 · 1 min read

Servers route by Host, so an IP may host admin or internal apps that have no public DNS record. Brute the Host header against the IP and diff responses.

bash

ffuf -w vhosts.txt -u https://TARGET_IP/ -H "Host: FUZZ.target.com" 
  -fs 0 -ac    # auto-calibrate to filter the default page

Confirm interesting hits by content length and title changes.

bash

gobuster vhost -u https://target.com -w vhosts.txt --append-domain

Pro note: use response size and word-count filtering to cut through the default vhost noise. Internal-only names discovered via CT logs make excellent Host values, since they often route to sensitive apps that assume they are unreachable from outside.