Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have to determine if a given subnet has virtual hosts.

Are there any ideas about what switches to use?

share|improve this question
Please add the tags nmap and virtual host.I dont have the neccessary reputation:) – py_script Apr 2 '11 at 14:48
When you say "virtual host" do you mean a virtualized OS, or website vhost? – Scott Pack Apr 2 '11 at 16:36
It is mentioned as virtual machines.SO I guess virtual OS. – py_script Apr 3 '11 at 10:52
I want to clarify something.This exercise was a past paper at a laboratory examination.So I dont have the comfort to write a script.I have to do it with nmap switces. – py_script Apr 3 '11 at 10:53
I added "virtual machines" to the question title based on your comment. But I'm puzzled now, after the accepted answer seems to focus on vhosts (multiple dns names sharing one web server and ip address). Of course the whole vhost setup can be within a virtual machine - is that what they meant? Should we change the question back to vhosts? – nealmcb Apr 15 '11 at 16:10
up vote 7 down vote accepted

You could use the Metasploit Framework HTTP Virtual Host Brute Force Scanner module.

Nmap is best launched from inside Metasploit. See the Metasploit Unleashed (free training available from Offensive-Security) section on Port Scanning for more information.

If the target IP address is available from the global Internet, then I suggest you also check out MyIPNeighbors and SHODAN, which are incredibly resourceful for this sort of reconnaissance activity.

Identification of caching servers, CDN infrastructure, reverse web proxies, load-balancers, internal IP prefixes, archived content, and associated hosts may also help during the investigation of virtual hosted infrastructure. Be sure to check out tools such as the Host/IP Pattern Extraction Tool (host-extract.rb), Halberd, The Web Archive, HTTP Archive, and W3AF.

To circle back to your original question, it is possible to scan for vhosts using an NSE (Nmap Scripting Engine) script called http-vhosts. However, it's good to know the intricacies of the entire target architecture before settling on a final decision about what has been / has not been discovered.

Typically, I find it easier to first find a path disclosure vulnerability that leads to a file read inclusion vulnerability -- and then to download the web server configuration in order to go through it manually. Or email/phone/text/DM/FaceBook-message the web server administrator who has access and then ask him or her for a copy of the web server configs.

share|improve this answer
Thanks...I will take a look at NSE. :) – py_script Apr 4 '11 at 19:18

The following link has a good overview of this :

Covers: 1. Why you need to enumerate 2. Techniques 2.1 DNS enumeration techniques 2.2 Banner grabbing 2.3 SSL/TLS Protocol enumeration techniques 2.4 HTTP Protocol enumeration techniques 2.5 Passive web enumeration techniques 2.6 Active web enumeration techniques

share|improve this answer

If it is a local subnet, you can get the MAC addresses of the hosts and check if they belong to vmware or other companies. Usually nobody bothers changing them. nmap will tell you too with -A switch etc.

share|improve this answer

At the bottom David Stubley's linked page is a link to a Ruby tool called hostmap that looks promising.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.