> For the complete documentation index, see [llms.txt](https://www.marialc.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.marialc.com/pentesterlab-labs/recon-badge/recon_06-vhost.md).
# recon\_06 (vhost)
View the exercise here: [PentesterLab: Recon 06](https://pentesterlab.com/exercises/recon_06/course)
### **OBJECTIVE**
For this challenge, your goal is to access the default virtual host ("vhost").
### **FUZZING DIRECTORIES**
When accessing a new webserver, it often pays off to replace the hostname with the IP address or to provide a random **Host** header in the request. To do this, you can either modify the request in a web proxy or use:
```bash
curl -H "Host: ...."
```
### **SOLUTION**
#### **Solution #1:**
Do DNS resolution to get IP.
**`dig`** (Domain Information Groper) is used to query DNS servers. This command will return details such as the A record (the IP address of `hackycorp.com`), which you’ll use in later steps.
```bash
dig hackycorp.com
```
{% hint style="success" %}
Connect the client to the IP address:
curl http://51.X.X.X/ -v
* The command makes a request to the IP address and shows you the entire process, including the HTTP headers and the response from the server. This helps you see how the server reacts, providing information that could lead to finding the key or solution for the challenge.
{% endhint %}
#### **Solution #2:**
{% hint style="success" %}
Access the IP on a browser to get the flag.
{% endhint %}
***
{% hint style="info" %}
#### **Additional Notes:**
```bash
curl http://hackycorp.com/ -v
```
* If we just use the URL, not the IP, we only get html response because we are accessing the website itself.
* The host header is different.
{% endhint %}
{% hint style="info" %}
#### Additional Notes (cont.):
But if we add a header, we'll get the flag:
```bash
curl http://hackycorp.com/ -v -H "Host: test"
```
* **`-v`** verbose option
* **`-H`** to add header
{% endhint %}
