New to security, so please forgive my ignornance - I have a machine with port 80 open, and I found the following information:

Starting Nmap 7.01 ( https://nmap.org ) at 2016-09-29 23:46 EDT
Nmap scan report for
Host is up (0.085s latency).
Not shown: 998 closed ports
22/tcp open  ssh?
80/tcp open  http    Apache httpd 2.4.7 ((Ubuntu))
|_http-server-header: Apache/2.4.7 (Ubuntu)
| http-title: Trees of Large Sizes
|_Requested resource was site/index.php/

This clearly is information about a website of some sort, but I'm not sure how to go about finding out what/where that website is? Any pointers would be super helpful.

  • What do you mean by where? If I'm understanding it right: apache default root directory is /var/www/html This website can be accessed by typing ip:port on your browser. Is that it? I suppose not.
    – RF03
    Oct 20, 2016 at 3:21
  • @RF03 As in what is the URL of this website?
    – 123
    Oct 20, 2016 at 3:24
  • ip:port is the URL.
    – RF03
    Oct 20, 2016 at 3:25
  • @RF03 That's what I figured, but it doesn't appear to work
    – 123
    Oct 20, 2016 at 3:28
  • Bing search - IP: - and try ng-recon
    – paj28
    Oct 20, 2016 at 6:47

3 Answers 3


HTTP 1.0 and up has the host header which allows virtual hosts, or more than one website on a single IP address. You cannot know which websites are hosted by the IP address without seeing the code/configuration on the server. Imagine a CDN's server that hosts static assets of thousands of completely unrelated sites. You can see the long list of domains in a cloudflare's certificate for an example server.

The default website which you get by not specifying the host header appears to be http://[ip]/site/index.php

  • Is there a way to discover a host header?
    – 123
    Oct 20, 2016 at 4:34
  • 1
    @123 No. It is sent by the browser. Open your /etc/hosts, invent a new domain name, set it to the ip of the server. Open a browser, navigate to the domain you invented. Your browser sent that domain in the host header of the request. The server might serve a special page only for that request. How many different web pages can the server serve for different domain names? As many as there are possible domain names. Infinity. Imagine the server is actually a proxy. How many websites are served by its IP address? All of them.
    – Z.T.
    Oct 20, 2016 at 5:07

Try , seems default doc root is /var/www/html/site


nmap like you invoked it only scans the port. If you want to get more info about what is being served by the web server, try

nmap -p 80 --script=http-enum <ip>

or try to run a directory scanner like dirbuster, which will brute force lots of popular url paths in order to see which one of them returns a http 200 instead of 404.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .