> For the complete documentation index, see [llms.txt](https://heinosass.gitbook.io/leet-sheet/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://heinosass.gitbook.io/leet-sheet/web-app-hacking/enumeration/webserver-virtualhost-subdomains.md).

# Webserver Virtualhost Subdomains

You can use a web fuzzer to enumerate whether the web server is configured with any subdomains. Change the "Host" header and see if the website responds with something different.

For example, to enumerate subdomains of `*.bart.htb`, you can do:

```
ffuf -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt -H "HOST:FUZZ.bart" -u http://bart:80 2>&1 
```