VHostScan - Virtual host scanner that can be used with pivot tools

VHOSTScan Wordlist example
A virtual host scanner that can be used with pivot tools, detect catch-all scenarios, aliases and dynamic default pages. First presented at SecTalks BNE in September 2017 (slidedeck).

Key Benefits

  • Quickly highlight unique content in catch-all scenarios
  • Locate the outliers in catch-all scenarios where results have dynamic content on the page (such as the time)
  • Identify aliases by tweaking the unique depth of matches
  • Wordlist supports standard words and a variable to input a base hostname (for e.g. dev.%s from the wordlist would be run as dev.BASE_HOST)
  • Work over HTTP and HTTPS
  • Ability to set the real port of the webserver to use in headers when pivoting through ssh/nc
  • Add simple response headers to bypass some WAF products


-h, --helpDisplay help message and exit
-t TARGET_HOSTSSet the target host.
-b BASE_HOSTSet host to be used during substitution in wordlist (default to TARGET).
-w WORDLISTSet the wordlist to use (default ./wordlists/virtual-host-scanning.txt)
-p PORTSet the port to use (default 80).
-r REAL_PORTThe real port of the webserver to use in headers when not 80 (see RFC2616 14.23), useful when pivoting through ssh/nc etc (default to PORT).
--ignore-http-codes IGNORE_HTTP_CODESComma separated list of http codes to ignore with virtual host scans (default 404).
--ignore-content-length IGNORE_CONTENT_LENGTHIgnore content lengths of specificed amount.
--unique-depth UNIQUE_DEPTHShow likely matches of page content that is found x times (default 1).
--sslIf set then connections will be made over HTTPS instead of HTTP.
--fuzzy-logicIf set then all unique content replies are compared and a similarity ratio is given for each pair. This helps to isolate vhosts in situations where a default page isn't static (such as having the time on it).
--wafIf set then simple WAF bypass headers will be sent.
-oN OUTPUT_NORMALNormal output printed to a file when the -oN option is specified with a filename argument.
-By passing a blank '-' you tell VHostScan to expect input from stdin (pipe).

Powered by Blogger.