Home

Awesome

VHostScan

A virtual host scanner that can be used with pivot tools, detect catch-all scenarios, aliases and dynamic default pages. First presented at SecTalks BNE in September 2017 (slidedeck).

Build Status Python 3.2|3.6 PEP8 License Twitter Twitter

Key Benefits

Product Comparisons

VHOSTScan Feature Map

Install on docker (recommended)

  1. ´git clone https://github.com/codingo/VHostScan.git´
  2. ´cd VHostScan´
  3. ´docker build -t vhostscan .`

Then run application `docker run --rm -it vhostscan -t´

Install Requirements

Install using:

$ python3 setup.py install

Dependencies will then be installed and VHostScan will be added to your path. If there is an issue regarding running python3 setup.py build_ext, you will need to reinstall numpy using pip uninstall numpy and pip install numpy==1.12.0. This should resolve the issue as there are sometimes issues with numpy being installed through setup.py.

Usage

ArgumentDescription
-h, --helpDisplay help message and exit
-t TARGET_HOSTSSet the target host.
-b BASE_HOSTSet host to be used during substitution in wordlist (default to TARGET).
-w WORDLISTSSet the wordlist(s) to use. You may specify multiple wordlists in comma delimited format (e.g. -w "./wordlists/simple.txt, ./wordlists/hackthebox.txt" (default ./wordlists/virtual-host-scanning.txt).
-p PORTSet the port to use (default 80).
-r REAL_PORTThe real port of the webserver to use in headers when not 80 (see RFC2616 14.23), useful when pivoting through ssh/nc etc (default to PORT).
--ignore-http-codes IGNORE_HTTP_CODESComma separated list of http codes to ignore with virtual host scans (default 404).
--ignore-content-length IGNORE_CONTENT_LENGTHIgnore content lengths of specificed amount.
--prefix PREFIXAdd a prefix to each item in the wordlist, to add dev-<word>, test-<word> etc
--suffix SUFFIXAdd a suffix to each item in the wordlist, to add <word>dev, <word>dev
--first-hitReturn first successful result. Only use in scenarios where you are sure no catch-all is configured (such as a CTF).
--unique-depth UNIQUE_DEPTHShow likely matches of page content that is found x times (default 1).
--sslIf set then connections will be made over HTTPS instead of HTTP.
--fuzzy-logicIf set then all unique content replies are compared and a similarity ratio is given for each pair. This helps to isolate vhosts in situations where a default page isn't static (such as having the time on it).
--no-lookupsDisbale reverse lookups (identifies new targets and append to wordlist, on by default).
--rate-limitAmount of time in seconds to delay between each scan (default 0).
--random-agentIf set, each scan will use a random user-agent from a predefined list.
--user-agentSpecify a user agent to use for scans.
--wafIf set then simple WAF bypass headers will be sent.
-oN OUTPUT_NORMALNormal output printed to a file when the -oN option is specified with a filename argument.
-oG OUTPUT_GREPABLEGrepable output printed to a file when the -oG is specified with a filename argument.
-oJ OUTPUT_JSONJSON output printed to a file when the -oJ option is specified with a filename argument.
-v VERBOSEIncrease the output of the tool to show progress

Usage Examples

Note that a number of these examples reference 10.10.10.29. This IP refers to BANK.HTB, a retired target machine from HackTheBox (https://www.hackthebox.eu/).

Quick Example

The most straightforward example runs the default wordlist against example.com using the default of port 80:

$ VHostScan -t example.com

Quick Example with SSL

If your connection requires SSL, you can use:

$ VHostScan -t example.com --ssl

VHOSTScan Wordlist example

Port forwarding

Say you have an SSH port forward listening on port 4444 fowarding traffic to port 80 on example.com's development machine. You could use the following to make VHostScan connect through your SSH tunnel via localhost:4444 but format the header requests to suit connecting straight to port 80:

$ VHostScan -t localhost -b example.com -p 4444 -r 80

STDIN

VHostScan Supports piping from other applications and will treat information passed to VHostScan as wordlist data, for example:

$ cat bank.htb | VHostScan -t 10.10.10.29

VHOSTScan STDIN Example

STDIN and WordList

You can still specify a wordlist to use along with stdin. In these cases wordlist information will be appended to stdin. For example:

$ echo -e 'a.example.com\b.example.com' | VHostScan -t localhost -w ./wordlists/wordlist.txt

Fuzzy Logic

Here is an example with fuzzy logic enabled. You can see the last comparison is much more similar than the first two (it is comparing the content not the actual hashes):

VHOSTScan Fuzzy Logic Example

Running the tests

This project includes a small battery of tests. It's really simple to run the tests:

pip install -r test-requirements.txt
python3 setup.py test

If you're thinking of adding a new feature to the project, consider also contributing with a couple of tests. A well-tested codebase is a sane codebase. :)