Find virtual hosts hidden behind shared IPs

One IP can serve many sites keyed by Host header; brute the header to reach internal apps not in DNS.