Discovering supported hostnames with Burp Suite - Port Swigger

Summary: PortSwigger describes using Burp Intruder to find hidden in-scope hosts by sending requests to the same IP address while varying the Host header to reach different back-end systems. The walkthrough uses the deliberately vulnerable portswigger-labs.net sandbox, marking a placeholder subdomain as a payload position, unchecking "Update Host header to match target," and sorting responses to spot inconsistent items such as the differing response length for staff.portswigger-labs.net.
Bottom line: Host-header enumeration surfaces back-end systems and access points that are in scope but never linked from the domains you started with, so your tested attack surface may be smaller than what an attacker can reach by sending the same request with a different Host header.

Read the original at PortSwigger Research ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026