Vhost / parameter fuzzing — FFUF

ffuf -w WORDLIST -H "Host:FUZZ.siteisup.htb" -u http://siteisup.htb -fs 1131
ffuf -w .../subdomains-top1million-110000.txt -H "Host:FUZZ.mentorquotes.htb" -u http://mentorquotes.htb -fw 18 -mc all
ffuf -w WORDLIST -X POST -d "user=^USER^" -H "Header" -u http://IP/FUZZ -mr "FALSE RESPONSE"

FFUF ignores 404 by default — use -mc all. Filter with -fs (size) / -fl (lines) / -fw (words).

🌐 DNS & Subdomain Enumeration

Vhost fuzzing with FFUF lives in Web-enum.

Records & lookups

whois megacorp.com -h 192.168.1.1      # search domain data via an IP
host -t mx megacorpone.com              # MX (mail) records
nslookup mail.megacorpone.com           # resolve a host
nslookup IP TXT/MX
dig domain.name TXT/MX
dig @IP AXFR domain.name                # zone transfer (AXFR)
whois SPECIFIC_IP                       # find IP range

Subdomain brute-force

dnsrecon -d megacorpone.com -D ~/list.txt -t brt
dnsrecon -t brt -D /usr/share/dnsrecon/namelist.txt -d ms01.oscp.exam
dnsenum megacorpone.com

Try different DNS names when stuck: test.oscp → main.test.oscp. See When-stuck.