# Fuzzing Subdomains and Virtual hosts

What is a Subdomain?

* is a domain that is part of a larger domain, it's the portion that appears before the main domain in a URL. example "http\://`school`.flight.htb"
* Subdomains are often used to organize and structure different sections or services within a website. They usually contain separate content, functionality or they could even point to different servers

What is a Virtual Host?

* A virtual host allows a single web server to host multiple domains (or subdomains) on the same physical machine or IP address
* With virtual hosting, the web server can differentiate between incoming requests based on the domain (or IP address) and serve the appropriate content
* The Two main mechanisms can be used to access a website on a virtual host

1. `HTTP`: With the use of the `HOST` request header.

<figure><img src="https://3268621211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQ0Egip1S9PA8zcUeKiqm%2Fuploads%2Ff5TCJ4kziOyoKk7fJZM1%2Fimage.png?alt=media&#x26;token=6c3c552d-874c-41fa-904c-9e17783df98e" alt=""><figcaption></figcaption></figure>

The client (us) uses the `Host` header to direct our request to the specified domain on the server.&#x20;

2. `HTTPS`: The Server Name Indication (SNI) extension within TLS, the client (us) when we establish a connection to the server our request would include the SNI within the handshake to specify the intended hostname, example request `ClientHello`

```
ClientHello:
  Random: 0x2b3ac5f7a7cf862d9f6548e13d4e9e5a
  Session ID: (empty)
  Cipher Suites: [TLS_AES_128_GCM_SHA256, TLS_AES_256_GCM_SHA384, ...]
  Compression Methods: [null]
  Extensions:
    - Server Name Indication Extension:
        server_name: www.example.com
    - Supported Elliptic Curves Extension: [secp256r1, secp384r1, secp521r1, ...]
    - Signature Algorithms Extension: [rsa_pkcs1_sha256, rsa_pkcs1_sha384, ...]
```

we can see within the SNI, the client (us) specifies the intended hostname we want to connect to being `www.example.com`

The main difference lies in their scope and purpose

* `Subdomains`: It is a way to structure and organize different sections or services under a domain name
* `Virtual Hosts`: It is a configuration on a web server that enables hosting mutiple domains or subdomains on the same server

### WFUZZ

wfuzz (subdomain)

```
wfuzz -c -f sub-fighter -Z -w /opt/SecLists/Discovery/DNS/subdomains-top1million-5000.txt --sc 200,202,204,301,302,307,403 "http://FUZZ.flight.htb"
```

* `-c`: is used to colorize the output
* `-f`: specifying a output name
* `-Z`: Option to disable SSL certificate warnings
* `-w`: wordlist being used
* `--sc 200,202,204,301,302,307,403`: Specifies the list of HTTP status codes to consider as valid responses. In this case, it's considering 200, 202, 204, 301, 302, 307, and 403 as valid.
* `"http://FUZZ.flight.htb"`: We specify the target URL where `FUZZ` will be replaced by elements from our wordlist

<figure><img src="https://3268621211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQ0Egip1S9PA8zcUeKiqm%2Fuploads%2F1VsFPuv6YycivPGw5TUK%2Fimage.png?alt=media&#x26;token=e322700a-bbb2-443d-8d4c-7b732233e947" alt=""><figcaption></figcaption></figure>

wfuzz (Virtual Hosts)

```
wfuzz -c -f sub-fighter -u 'http://flight.htb' -H 'Host:FUZZ.flight.htb' -w /opt/SecLists/Discovery/DNS/subdomains-top1million-20000.txt --hc 200
```

The main difference from fuzzing subdomains is we are actually fuzzing the `Host` request header, specifying different subdomains to sent to the web server

* `-c`: This option tells `wfuzz` to colorize the output for better readability.
* `-f sub-fighter`: This specifies the format for the output file, and it uses the format named "sub-fighter."
* `-u 'http://flight.htb'`: This specifies the target URL, which is the website `http://flight.htb`.
* `-H 'Host:FUZZ.flight.htb'`: This is setting a custom HTTP header (`Host`) with the value 'FUZZ.flight.htb'. The keyword 'FUZZ' is a placeholder that `wfuzz` will replace with entries from the wordlist.
* `-w`: specifies the wordlist to be used
* `--hc`: This sets the HTTP response code to ignore
