Domain + VHost Fuzzing

Domain

• 
• sudo sh -c 'echo "SERVER_IP academy.htb" >> /etc/hosts'
• Now, when we try to access academy.htb we will get a response.
• From here, we can search for subdomains - *.academy.htb

---

Public Domains

• ffuf -w /opt/SecLists/Discovery/DNS/subdomains-top1million-5000.txt:FUZZ -u https://FUZZ.inlanefreight.com/

Private Domains:

• doing the above on academy.htb that we added to our /etc/hosts file
• 

---

VHost Fuzzing

• 
• Fuzzing the Host: header
  
• ffuf -w /opt/useful/seclists/Discovery/DNS/subdomains-top1million-5000.txt:FUZZ -u http://academy.htb:PORT/ -H 'Host: FUZZ.academy.htb'
• gobuster vhost -u http://<target_IP_address>:<port> -w /opt/SecLists/Discovery/DNS/subdomains-top1million-5000.tx --append-domain
  • -t <number> - Use number of threads
  • -k - Ignore SSL/TLS certificate errors
  • -o - Save the output