Skip to main content
Name:vhostscan
Category:Recon
Publisher:trickest
Created:6/23/2021
Container:quay.io/trickest/vhostscan:4a3a1ee
Output Type:
License:Unknown

Parameters

​
ssl
boolean
--sslIf set then connections will be made over HTTPS instead of HTTP.
​
waf
boolean
--wafIf set then simple WAF bypass headers will be sent.
​
port
string
-pSet the port to use (default 80).
​
base-host
string
-bSet host to be used during substitution in wordlist (default to TARGET).
​
real-port
string
-rThe real port of the webserver to use in headers when not 80 (see RFC2616 14.23), useful when pivoting through ssh/nc etc (default to PORT).
​
wordlists
file
-wSet the wordlist(s) to use. You may specify multiple wordlists in comma delimited format (e.g. -w ./wordlists/simple.txt, ./wordlists/hackthebox.txt (default ./wordlists/virtual-host-scanning.txt).
​
user-agent
string
--user-agentSpecify a user agent to use for scans.
​
fuzzy-logic
boolean
--fuzzy-logicIf set then all unique content replies are compared and a similarity ratio is given for each pair. This helps to isolate vhosts in situations where a default page isn't static (such as having the time on it).
​
random-agent
boolean
--random-agentIf set, each scan will use a random user-agent from a predefined list.
​
target-hosts
string
required
-tSet the target host.
​
ignore-http-codes
string
--ignore-http-codesComma separated list of http codes to ignore with virtual host scans (default 404).
​
ignore-content-length
string
--ignore-content-lengthIgnore content lengths of specificed amount.
​
Delay-between-each-scan
string
--rate-limitAmount of time in seconds to delay between each scan (default 0).
​
Disable-reverse-lookups
boolean
--no-lookupsDisbale reverse lookups (identifies new targets and append to wordlist, on by default).
​
First-successful-result
boolean
--first-hitReturn first successful result. Only use in scenarios where you are sure no catch-all is configured (such as a CTF).
​
Suffix-to-items-in-wordlist
string
--suffixAdd a suffix to each item in the wordlist, to add <word>dev, <word>dev
​
Prefix-to-items-in-wordlists
string
--prefixAdd a prefix to each item in the wordlist, to add dev-<word>, test-<word> etc