What is the intent for the "-vhost-input" option?

[CyberStryk]

Does anyone know what the original idea for the -vhost-input httpx option was and/or is?

I'm working an httpx feature to add vhost support (setting the "Host: CustomHost>" header in the request). The help menu for -vhost-input sounds to me like it should take a list of vhosts as an input and run those as vhosts against all the targets. Is this the intended functionality?

It's currently a scanoption as a boolean value and doesn't seem like it's used much in the current release.

Looking for any feedback anyone can provide. If it turns out I have the right idea of what it's for I'll use it in my fork. If not I'll need to create a new option.

Thanks for your help!

[DFC302]

From my understanding, the option is used to determine if the host you are scanning is using virtual hosting.

I am more interested in understanding how it determines valid vhosts, so easily.

But in response to your question, I don't think it's intended to take a list of vhosts as much as it's intended for you you to feed a list of hosts and use the option to determine which hosts are vhosts and which are not. So far, in my experience it has been fairly accurate. I hope that makes sense.

[CyberStryk]

Thanks for the response!

I was under the impression that the "-vhost - probe and display server supporting VHOST" option from the help is for the functionality you described above. That flag will show which servers are potentially running vhost. Is that different than what you're saying -vhost-input does?

[intrd]

It seems that the -vhost-input option is still not working. The only method I found was using -H "Host: vhost", but that only tests one vhost at a time, not a list, which I believe would be the intended function of this option.

[stefanovettorazzi]

I tried this feature and it doesn't work for me.
Passing the -debug and -verbose flags doesn't show any progress.
I'm probably missing something, but I'm not sure.
It looks that it's implemented but I get no errors and there are no requests made to the target.
The command I'm using is: httpx -u ip_of_the_target -vhost-input list_of_vhosts.txt.