I'm currently learning how to discover web applications running on a machine using port scanning, vhost bruteforcing and directory fuzzing. When it comes to port scanning, there is one thing I can't wrap my head around.
Let's say I have scanned all ports on a host and discovered a HTTP service exposed. To validate it's indeed HTTP, I would send a GET request to that port and examine the response:
$ telnet <IP> 8080 Trying <IP>... Connected to <IP>. Escape character is '^]'. GET / HTTP/1.1 HTTP/1.1 200 OK Content-Type: text/html <snip...>
But even if it is HTTP, can I be sure there aren't any virtual hosts configured that require the HTTP Host header field for the request to reach them?