sub-domain vs v-host

The key difference between Vhost and sub-domains is that a Vhost is basically a 'sub-domain' served on the same server and has the same IP, such that a single IP could be serving two or more different websites.

Sub-domain enumeration

Dig

for sub in $(cat /opt/useful/SecLists/Discovery/DNS/subdomains-top1million-110000.txt);do dig "$domain" @"$ip" |grep -v ';\|SOA'|sed -r '/^\s*$/d'|grep $sub|tee -a subdomains_dig.txt;done

Dns Enum

dnsenum --enum "$domain" -f /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt -r

Dns Enum

dnsenum --dnsserver "$ip" --enum -p 0 -s 0 -o subdomains_dnsenum.txt -f /usr/share/seclists/Discovery/DNS/fierce-hostlist.txt --threads 90 "$domain"

---

Vhost enumeration

Gobuster

gobuster vhost -u http://"$domain":53 -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt -t 25 --append-domain -o vhost_"$ip"_gobuster.out

FFUF

ffuf -u http://"$ip":8080 -H "Host: FUZZ.$domain" -mc 200 -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt -t 80 -fs 116 -o vhost_"$ip"_ffuf.out

							OR

ffuf -c -w /opt/useful/seclists/Discovery/DNS/subdomains-top1million-5000.txt:FUZZ -u "$ip" -H "Host: FUZZ.$domain"