> For the complete documentation index, see [llms.txt](https://sarpers-organization.gitbook.io/ctftricks/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://sarpers-organization.gitbook.io/ctftricks/_chapter-intro-17/enumeration/trick-0032.md).

# Subdomain Discovery Via Fuzzing

***

Discover hidden subdomains by fuzzing the `Host` header against the target server's IP address rather than its domain name. This is useful for finding virtual hosts configured on the server.

FFUF can be used to discovery subdomains by the use of virtual hosts and changing the Host header. Try running the below ffuf command:

```bash
ffuf -u http://TARGET_IP/ -H 'host : FUZZ.domain.thm' -w /path/to/subdomains-wordlist -fs FILTER_SIZE
```

Virtual host enumeration involves finding hidden domains or subdomains hosted on a server by testing different Host headers against the server's IP address. You can use FFUF for virtual host fuzzing. An example command is:

```bash
ffuf -w wordlists/subdomains.txt -u http://TARGET_IP/ -H "Host: FUZZ.target.com" -fs 123
```

The `-fs` flag is crucial for filtering out responses identical to the default page served when no specific `Host` header matches. Obtain the filter size by making a request to the target IP without a specific `Host` header first. Successful subdomain hits will typically return a different response size or content. The `-fs` flag allows us to filter responses by size, which is useful when the server returns the same page for all requests, regardless of the Host header.