> For the complete documentation index, see [llms.txt](https://www.marialc.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.marialc.com/pentesterlab-labs/recon-badge/recon_11-virtual-host-brute.md).
# recon\_11 (virtual host brute)
View the exercise here: [PentesterLab: Recon 11](https://pentesterlab.com/exercises/recon_11/course)
### **OBJECTIVE**
For this challenge, your goal is to brute a virtual host.
### **VIRTUAL HOST BRUTE FORCING**
In this challenge, you need to brute force a virtual host by only manipulating the **Host** header. There is no DNS resolution setup for this host. Therefore you will need to target **hackycorp.com** and bruteforce the virtual host (that ends in **.hackycorp.com**).
### **SOLUTION**
Without fuzzing yet, when we try to enter a random subdomain, we get the recon\_07 flag, which is not the goal for recon\_11.
```bash
curl https://hackycorp.com -H 'Host:random123.hackycorp.com'
```
So we will be using ffuf (Fuzz Faster U Fool), a fast and flexible web fuzzer designed for discovering hidden files, directories, and parameters on web servers. It automates brute-forcing tasks using wordlists, helping penetration testers and security researchers quickly identify potential security issues in web applications.
{% embed url="" %}
This is used to find valid virtual hosts or subdomains by fuzzing the `Host` header with values from a wordlist and filtering out responses that match a specific size.
{% hint style="info" %}
```bash
ffuf -w /path/to/vhost/wordlist -u https://target -H "Host: FUZZ" -fs 4242
```
* **`-w /path/to/vhost/wordlist`**: Specifies the wordlist file that contains potential subdomain or vhost names to try. Each line in this file is used in place of `FUZZ`.
* **`-u https://target`**: The base URL of the target web server where the fuzzing will take place.
* **`-H "Host: FUZZ"`**: This sets the `Host` header in the HTTP request to the value of each entry in the wordlist. `FUZZ` is a placeholder that gets replaced by each word from the wordlist.
* **`-fs 4242`**: Filters out responses that have a content size of 4242 bytes. This is used to ignore "false positives" by not showing responses that match this size.
{% endhint %}
{% hint style="info" %}
To filter recon\_07 in the response:
{% code overflow="wrap" %}
```bash
ffuf -w /usr/share/wfuzz/wordlist/general/common.txt -u https://hackycorp.com -H "Host: FUZZ.hackycorp.com" -fr recon_07
```
{% endcode %}
* **`-fr recon_07`**: Filters out responses that contain the string `recon_07`. This helps in ignoring responses that are not relevant to your fuzzing target.
{% endhint %}
We get `admin` & `www`.
{% hint style="success" %}
We’ll curl the ones we fuzzed to get the recon\_11 flag.
```bash
curl https://hackycorp.com -H 'Host: admin.hackycorp.com'
```
{% endhint %}
