312-50 Question 284
Single answer▪ Web Server ConceptsDuring an authorized assessment, you discover that a company's public web server responds differently based on the HTTP Host header. Requests sent to the server's IP address return a generic page, but when you send requests with different Host values, you receive distinct applications and error pages. The security team wants to identify additional websites hosted on the same server before expanding the test scope. Which technique is the most appropriate next step?
- A
Perform virtual host enumeration by sending requests with candidate Host headers and reviewing the responses
- B
Run an SNMP walk against the web server to retrieve the list of hosted websites
- C
Capture ARP traffic from the server to identify all domain names configured in the web service
- D
Use traceroute to enumerate the server's name-based virtual hosts
Show answer and explanation
Correct answer: A
Explanation
The key clue is that the server returns different content depending on the HTTP Host header. That behavior is characteristic of name-based virtual hosting, a common web server configuration in Apache HTTP Server, Nginx, and Microsoft IIS. In such cases, the same IP address can host multiple websites, and the web server selects the site based on the Host header supplied by the client. From a CEH perspective, the appropriate technique is virtual host enumeration, which is an application-layer discovery method. Testers commonly send requests with likely domain names or wordlist-derived subdomains in the Host header and then compare response differences to identify additional sites. This aligns with HTTP/1.1 requirements that use the Host header to identify the target resource on shared servers, and with practical web enumeration methodology documented in vendor documentation and HTTP standards such as RFC 9110. Network-layer tools like traceroute or ARP analysis do not solve this problem because the distinction between sites exists at the HTTP layer, not the routing or local link layer.
- A. Correct.
Correct. This scenario describes name-based virtual hosting, where a single web server serves different content depending on the HTTP Host header. A practical next step is virtual host enumeration: sending HTTP requests with different candidate Host values and comparing status codes, content length, titles, certificates, or error messages to identify additional hosted applications. This is a standard web server enumeration technique during authorized testing.
- B. Incorrect.
Incorrect. SNMP can expose useful system information if enabled and misconfigured, but it is not the appropriate or reliable method for enumerating name-based virtual hosts on a web server. Many web servers do not expose hosted site definitions via SNMP, and SNMP is often disabled on public-facing web servers.
- C. Incorrect.
Incorrect. ARP is a Layer 2 protocol used for local network address resolution and does not provide a list of domain names configured in a web server. In addition, an external tester targeting a public web server typically would not be in a position to capture the server's local ARP traffic in a meaningful way.
- D. Incorrect.
Incorrect. Traceroute helps identify network paths and intermediate hops between systems. It does not enumerate websites or name-based virtual hosts hosted on a web server. A candidate might choose this if confusing network discovery with application-layer enumeration, but the problem specifically involves HTTP Host header behavior.