Optimization

What does the web server setting do when configuring a network scan?

This setting allows users to register multiple virtual host names, that can be used in the HTTP
level and also in all TLS connections.

Example Scenarios

  • Identify HTTP servers that utilize the Host Header to manage multiple domains hosted on the same IP address.
  • Identify HTTP servers that leverage TLS Server Name Indication to present different certificates for various domains.
  • Any port recognized as using TLS will employ the Server Name Indication field to transmit TLS packets associated with the specified virtual host name.

Improved Findings

  • This functionality will allow us to obtain certificates from servers corresponding to the registered virtual host names. Additionally, it will enhance HTTP protocol requests by ensuring the correct host header is utilized. Furthermore, for services that implement Server Name Indication, we will validate their ability to provide different responses based on the specified protocol.

Scan Duration

As we send TLS packets for each registered virtual host name on TLS ports, the total number of packets generated will increase proportionally with the number of virtual host names. This increase in packet volume will subsequently affect the overall duration of the scan.

Example Packets difference

  • 1 IP , 0 virtual hosts, 1 port => 1 packet => 1 response will be analyzed for the vulnerability.
  • 1 IP , 4 virtual hosts, 1 port => 4 packets => 4 different responses will be analyzed for the same vulnerability.