How Virtual Hosts Work#

Virtual hosting allows multiple websites or applications to be hosted on the same IP address. The web server can identify the correct website to serve by using the HTTP Host header, which is part of the request sent by the browser. Here’s how it works:

1. DNS Resolution: The browser queries the DNS to resolve the domain name (e.g., www.example.com) into an IP address.
2. Host Header: The browser sends an HTTP request to the web server, including the domain name in the “Host” header.
3. Web Server: The web server examines the Host header and finds the corresponding virtual host configuration.
4. Serving Content: Based on the configuration, the web server serves the appropriate website by retrieving files from the correct DocumentRoot.

Virtual Hosts vs. Subdomains#

There is a key difference between Virtual Hosts and Subdomains, and it mainly involves their relationship to DNS and server configurations:

• Subdomains: A subdomain is a prefix added to the main domain (e.g., blog.example.com). Subdomains can have their own DNS records pointing to either the same IP address or a different one. They are typically used for organizing various sections or services of a website.
• Virtual Hosts: Virtual hosts are configurations within a web server that enable the hosting of multiple websites, either on the same domain or subdomains. Each virtual host has its own configuration and can be associated with different domain names or subdomains.

While subdomains may not always have public DNS records (e.g., internal or non-public subdomains), virtual hosts can also be configured to serve subdomains or top-level domains, providing flexibility in server configuration.

Types of Virtual Hosting#

There are three primary types of virtual hosting:

1. Name-Based Virtual Hosting:
   • This is the most common and flexible method. It uses the Host header in the HTTP request to determine which website to serve. Multiple websites can share the same IP address.
   • Advantages: Cost-effective, easy to set up, and supports most modern web servers.
   • Limitations: May have issues with certain protocols (e.g., SSL/TLS).
2. IP-Based Virtual Hosting:
   • Each website on the server gets its own unique IP address. The server uses the IP address in the incoming request to determine which website to serve.
   • Advantages: Can work with any protocol and provides better isolation between websites.
   • Limitations: Requires multiple IP addresses, which can be expensive.
3. Port-Based Virtual Hosting:
   • Different websites are hosted on different ports (e.g., one site on port 80 and another on port 8080). This method requires the user to specify the port number in the URL.
   • Advantages: Useful when IP addresses are limited.
   • Limitations: Not very user-friendly, and requires port specification in URLs.

Virtual Host Configuration Example#

Here’s an example of how you might configure multiple virtual hosts on Apache using Name-Based Virtual Hosting:

<VirtualHost *:80>
    ServerName www.example1.com
    DocumentRoot /var/www/example1
</VirtualHost>

<VirtualHost *:80>
    ServerName www.example2.org
    DocumentRoot /var/www/example2
</VirtualHost>

<VirtualHost *:80>
    ServerName www.another-example.net
    DocumentRoot /var/www/another-example
</VirtualHost>

In this example, the web server will serve different websites (e.g., example1.com, example2.org, another-example.net) from the same IP address using the Host header to determine which one to load.

Server Virtual Host Lookup Process#

1. Request: When a user types a domain name into their browser (e.g., www.inlanefreight.com), the browser sends an HTTP request to the web server.
2. Host Header: The browser includes the domain in the Host header of the HTTP request.
3. Web Server Configuration: The server examines the Host header and matches it to a configured virtual host.
4. Serving Content: The server retrieves the appropriate files from the correct DocumentRoot and sends them back to the browser.

Virtual Host Discovery and Fuzzing#

In cybersecurity, discovering virtual hosts can reveal public and private subdomains or even misconfigured virtual hosts. VHost fuzzing is a technique used to test various hostnames against an IP address to uncover hidden or misconfigured virtual hosts.

Tools for Virtual Host Discovery#

Here are some tools used for virtual host discovery:

• Gobuster: A tool that performs directory/file brute-forcing but can also be used for virtual host discovery by brute-forcing the Host header.

  Example command for running Gobuster to discover virtual hosts:

  gobuster vhost -u http://<target_IP_address> -w <wordlist_file> --append

• Feroxbuster: Similar to Gobuster but with improved speed and flexibility. It supports recursion and advanced filtering options.

• ffuf: Another web fuzzer that can be used to fuzz the Host header and discover virtual hosts.

Conclusion#

Virtual hosting is an essential feature of modern web servers, allowing multiple websites or applications to be hosted on a single server. Understanding the different types of virtual hosting and how they work is crucial for managing and securing web applications. Tools like Gobuster and Feroxbuster can help discover hidden virtual hosts, which can be a valuable asset for security assessments and penetration testing.