vhost Enumeration
Last updated
Last updated
Notice that you will get back responses with a similar character count, these are often the ones that will fail, to make the output more readable, filter on the bad character count and look for one with a unique character count.
In this example we know the first part of the subdomain used by the company, however we need to bruteforce the second half of the sub domain.
Sometimes the web server will 302 your request when bruteforcing for subdomains.
First create a new burp listener as such
Now you can use the below command and throw all the requests through the burp proxy to view the requests
Browsing to burp, we can see all the requests and the 302 redirects. Try and figure out what stands out, if most requests are 302's look for 404's or other status codes
Apply our filter removing all 302's
Below is a command to filter the status code without using a burp proxy
-b Cookie data "NAME1=VALUE1; NAME2=VALUE2" for copy as curl functionality.
-mc Match HTTP status codes, or "all" for everything. (default: 200,204,301,302,307,401,403)
