> For the complete documentation index, see [llms.txt](https://lswsec.gitbook.io/lswsec-offensive/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://lswsec.gitbook.io/lswsec-offensive/web/web-fuzzing-with-ffuf/domain-fuzzing.md).

# Domain Fuzzing

<pre><code># add domain to etc/hosts
sudo sh -c 'echo "Server_IP domain.htb" >> /etc/hosts'

#search for domains using seclists dns > subdomains
ffuf -w /path/to/subdomains.txt:FUZZ -u https://FUZZ.domain.com/

#scan for vhosts if there are no public subdomains (look for different response sizes)
<strong>ffuf -w /path/to/subdomain.txt:FUZZ -u http://domain.com:port/ -H 'HOST:FUZZ.domain.com'
</strong>
#to filter out specific codes use '-fs 900'
ffuf -w /path/to/subdomain.txt:FUZZ -u http://domain.com:port/ -H 'HOST:FUZZ.domain.com' -fs 900

</code></pre>