Accessing Localhost via Vhost | VIRTUAL HOST ENUMERATION | BugBounty POC
What virtual hosts (or vhosts)?
A single web server can be configured to run multiple websites at once, under different domain names. These are the virtual hosts (or vhosts) and they are usually found in shared hosting environments.
Why you need to Enumerate?
The host name discovery phase is an information gathering act to get a complete and detailed view of target resources and attack points. During an attack or a penetration test, the attacker needs to known as much information as possible about the entry points to attack. An entry point can be identified with an IP address, a service port, and some application level information, like the virtual host name in the case of a web server hosting several sites. As a penetration tester, finding all the vhosts that run on a web server (based on its IP address) is important because each website may contain vulnerabilities that affect the same server. Furthermore, if one website is compromised, there is a high chance that the attacker gains unauthorized access to the other websites also that are running on the same server. Hence, testing all the vhosts is necessary for a complete coverage of the penetration test.
So! Last night i was testing a Bug Bounty Program, so I get to the Vhosts enumeration part I uses some basic tools and Common names of Vhosts manually to get a Positive response.
Tools?
there are many tools available to enumerate Vhosts But some of the best tools are as follows! https://github.com/jobertabma/virtual-host-discovery ( By Jobert abma ) https://pentest-tools.com/information-gathering/find-virtual-hosts ( Pentest-tools ) https://nmap.org/nsedoc/scripts/http-vhosts.html ( Nmap http-vhosts ) I was checking manually for common Vhosts like, app,beta,admin,webmail,localhost when i hit a positive response on the Vhost “localhost” That gave me “200 OK” response, and Luckily it had Directory listing enabled ;) so I got access to a Juicy part of the website
Now I decided to Hunt for some stuff so that i can report the issue to the company!
What Data i got from the localhost? Well I was able to download files like, .yml,.php,.xml.json etc and The some data type i found in the files was
- MYSQL_ROOT_PASSWORD
- MYSQL_DATABASE
- Open ports
- Emails
- Banner and Version Numbers
- RABBITMQ_DEFAULT_USER
- RABBITMQ_DEFAULT_PASS
- Network Information
- API_KEYS
- Log Files
- Github Tokens
etc,… I reported the issue To the company They resolved it after a little chat ( Coz The subdomain i found it on was out of scope ) and I got Paid ;)
Also here’s a Common Wordlist i use to Enumerate Vhosts :)
%s 127.0.0.1 admin admin.%s administration administration.%s ads adserver alerts alpha alpha.%s ap apache api app apps appserver aptest auth backup beta beta.%s blog cdn chat citrix cms corp crs cvs dashboard database db demo dev dev.%s devel development development.%s devsql devtest dhcp direct dmz dns dns0 dns1 dns2 download en erp eshop exchange f5 fileserver firewall forum ftp ftp0 git gw help helpdesk home host http id images info internal internet intra intranet ipv6 lab ldap linux local localhost log m m.%s mail mail2 mail3 mailgate main manage mgmt mirror mobile mobile.%s monitor mssql mta mx mx0 mx1 mysql news noc ns ns0 ns1 ns2 ns3 ntp old old.%s ops oracle owa pbx portal s3 secure secure.%s server sharepoint shop sip smtp sql squid ssh ssl stage staging staging.%s stats status status.%s svn syslog test test1 test2 testing uat uat.%s upload v1 v1.%s v2 v2.%s v3 v3.%s vm vnc voip vpn web web2test whois wiki www www.%s www2 xml administrator webmail door phone lol test tester vmm local localadmin admin10 admin01 blogadmin about