Do you know how to find out if a website hides another one behind? 

👻A hidden website. 
But associated with the same IP address. A ghost in plain sight.
 
Well, it's curious, typical and simple. 
I'll leave you the 🔦🧵

What is a "Virtual Host"? 

It is a way to have a diversity of services on the same machine. 

It is like having a doorman in the building.

CEO of 
@academia_qa
 ¡Construyendo soluciones escalables y transparentes para el 🌎 en el que quiero vivir! #MujeresEnIT #MujeresEnCrypto 🌈

Just like "admin", it could be any word ✏️

That's the fun part. 

You have to find out WHICH word it is 👇

There are a thousand ways if it's set up wrong. 

But we're going to do it the cool way. 

The beast way. Brute force 💪

Example: I will do it on a machine that uses "Virtual Hosting". 

The web would be "devvortex.htb" (don't look for it, it doesn't really exist😶‍🌫️) 

This would be the main site

We are going to use WFUZZ. 

This tool for these things 🚀

With this command, I try all subdomains (urls that are xxxxxx.devvortex.htb) 

Until one of them works 🤓

In this case: "dev"

I explain you the command 

1️⃣ devvortex.htb - is the original page 
2️⃣ subdomains.txt - is the list for rough testing 
3️⃣ sub-fighter - is the mode, against virtual hosts 
4️⃣ Host - is a header, so test 1 by 1

Let's see 👀

Now I access the website "dev.devvortex.htb". 

And wow, we have found a ghost website 👻

This is a classic strategy for gathering information. ✏️

It is part of the "recognition" of a web security test. 🔏