I have to determine if a given subnet has virtual hosts.

Are there any ideas about what switches to use?

  • I want to clarify something.This exercise was a past paper at a laboratory examination.So I dont have the comfort to write a script.I have to do it with nmap switces.
    – py_script
    Commented Apr 3, 2011 at 10:53
  • 1
    I added "virtual machines" to the question title based on your comment. But I'm puzzled now, after the accepted answer seems to focus on vhosts (multiple dns names sharing one web server and ip address). Of course the whole vhost setup can be within a virtual machine - is that what they meant? Should we change the question back to vhosts?
    – nealmcb
    Commented Apr 15, 2011 at 16:10

5 Answers 5


You could use the Metasploit Framework HTTP Virtual Host Brute Force Scanner module.

Nmap is best launched from inside Metasploit. See the Metasploit Unleashed (free training available from Offensive-Security) section on Port Scanning for more information.

If the target IP address is available from the global Internet, then I suggest you also check out MyIPNeighbors and SHODAN, which are incredibly resourceful for this sort of reconnaissance activity.

Identification of caching servers, CDN infrastructure, reverse web proxies, load-balancers, internal IP prefixes, archived content, and associated hosts may also help during the investigation of virtual hosted infrastructure. Be sure to check out tools such as the Host/IP Pattern Extraction Tool (host-extract.rb), Halberd, The Web Archive, HTTP Archive, and W3AF.

To circle back to your original question, it is possible to scan for vhosts using an NSE (Nmap Scripting Engine) script called http-vhosts. However, it's good to know the intricacies of the entire target architecture before settling on a final decision about what has been / has not been discovered.

Typically, I find it easier to first find a path disclosure vulnerability that leads to a file read inclusion vulnerability -- and then to download the web server configuration in order to go through it manually. Or email/phone/text/DM/FaceBook-message the web server administrator who has access and then ask him or her for a copy of the web server configs.

If you are on local LAN (force with --send-eth), you can map the MAC Address' OUI 12-bit extension identifier map to the org assigned by the IEEE Registry Authority. Nessus and some other tools do this by default. My favorite is NetworkMiner of the traffic, as it also provides a sample of packet analysis and gives a good view of what happened for proactive troubleshooting.


The following link has a good overview of this :


Covers: 1. Why you need to enumerate 2. Techniques 2.1 DNS enumeration techniques 2.2 Banner grabbing 2.3 SSL/TLS Protocol enumeration techniques 2.4 HTTP Protocol enumeration techniques 2.5 Passive web enumeration techniques 2.6 Active web enumeration techniques


If it is a local subnet, you can get the MAC addresses of the hosts and check if they belong to vmware or other companies. Usually nobody bothers changing them. nmap will tell you too with -A switch etc.


At the bottom David Stubley's linked page is a link to a Ruby tool called hostmap that looks promising.



All the KVM VMs ports are filtered by the KVM host, so on a LAN you can select any arbitrary port (65535), and look for the filtered ones:

nmap -p 65535 -oG - | grep filtered| awk '{print $2,$3}'

But the firewalls and the KVM VMs should show up in this scan too.

ESXi hosts should have port 902 open:

nmap -p 902 -oG - | grep open | awk '{print $2,$3}'

The ESXi hosts should show up in that scan.

  • This may help you find the hypervisor the machines are running on, but probably won't help find the actual virtual machines. Commented May 7, 2019 at 23:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .