Rewrite vhost module as virtualhost with native blasthttp

[liquidsec]

Summary

Complete rewrite of the vhost module (now renamed to virtualhost). The old module was a thin wrapper around the ffuf Go binary for Host header fuzzing. The new module is a native Python implementation using blasthttp for all HTTP requests, with significantly expanded detection capabilities.

Requires #2992 (blasthttp integration). Supersedes #2672.

What changed from the old vhost module

Architecture:

• No longer inherits from ffuf or shells out to any external binary
• All HTTP requests go through self.helpers.request() with resolve_ip for DNS pinning
• Uses blasthttp cert_info for certificate SAN extraction
• Response comparison via simhash instead of ffuf size/word/line filters

New detection capabilities:

• Wildcard detection via single-character hostname mutation
• Canary consistency re-verification before emitting results
• Keyword-based wildcard filtering
• Certificate SAN extraction via blasthttp cert_info
• Interesting default content reporting
• HTTPS virtual host support via SNI control with resolve_ip
• Configurable simhash similarity threshold (default 0.8)

Event changes:

• Produces VIRTUAL_HOST (was VHOST), DNS_NAME_UNVERIFIED, and HTTP_RESPONSE
• Detailed descriptions with status code, title, size, IP, accessibility

Renamed: vhost -> virtualhost, VHOST -> VIRTUAL_HOST, deadly flag removed

[github-actions]

📊 Performance Benchmark Report

Comparing blasthttp-integration-clean (baseline) vs add-virtualhost-module (current)

📈 Detailed Results (All Benchmarks)

📋 Complete results for all benchmarks - includes both significant and insignificant changes

🧪 Test Name	📏 Base	📏 Current	📈 Change	🎯 Status
Bloom Filter Dns Mutation Tracking Performance	4.29ms	4.27ms	-0.4% ⚪	✅
Bloom Filter Large Scale Dns Brute Force	17.35ms	20.25ms	+16.7% 🟡🟡	⚠️
Large Closest Match Lookup	340.57ms	333.53ms	-2.1% ⚪	✅
Realistic Closest Match Workload	180.87ms	178.61ms	-1.3% ⚪	✅
Event Memory Medium Scan	1784 B/event	1784 B/event	+0.0% ⚪	✅
Event Memory Large Scan	1768 B/event	1768 B/event	+0.0% ⚪	✅
Event Validation Full Scan Startup Small Batch	374.31ms	379.02ms	+1.3% ⚪	✅
Event Validation Full Scan Startup Large Batch	523.49ms	525.40ms	+0.4% ⚪	✅
Make Event Autodetection Small	24.99ms	24.66ms	-1.3% ⚪	✅
Make Event Autodetection Large	254.02ms	250.94ms	-1.2% ⚪	✅
Make Event Explicit Types	10.63ms	10.46ms	-1.6% ⚪	✅
Excavate Single Thread Small	3.423s	3.364s	-1.7% ⚪	✅
Excavate Single Thread Large	8.737s	8.635s	-1.2% ⚪	✅
Excavate Parallel Tasks Small	3.652s	3.601s	-1.4% ⚪	✅
Excavate Parallel Tasks Large	6.077s	6.020s	-0.9% ⚪	✅
Is Ip Performance	3.18ms	3.17ms	-0.1% ⚪	✅
Make Ip Type Performance	11.30ms	11.29ms	-0.2% ⚪	✅
Mixed Ip Operations	4.53ms	4.44ms	-1.9% ⚪	✅
Memory Use Web Crawl	163.9 MB	170.5 MB	+4.0% ⚪	✅
Memory Use Subdomain Enum	19.4 MB	19.4 MB	+0.0% ⚪	✅
Scan Throughput 100	3.531s	3.992s	+13.1% 🟡🟡	⚠️
Scan Throughput 1000	27.092s	31.556s	+16.5% 🟡🟡	⚠️
Typical Queue Shuffle	64.41µs	61.51µs	-4.5% ⚪	✅
Priority Queue Shuffle	722.07µs	705.75µs	-2.3% ⚪	✅

🎯 Performance Summary

! 3 regressions ⚠️
  21 unchanged ✅

🔍 Significant Changes (>10%)

• Bloom Filter Large Scale Dns Brute Force: 16.7% 🐌 slower
• Scan Throughput 100: 13.1% 🐌 slower
• Scan Throughput 1000: 16.5% 🐌 slower

---

🐍 Python Version 3.11.15

[codecov]

Codecov Report

❌ Patch coverage is 85.23490% with 132 lines in your changes missing coverage. Please review.
✅ Project coverage is 91%. Comparing base (e7e61a9) to head (c9ac70e).
⚠️ Report is 133 commits behind head on blasthttp-integration-clean.

Files with missing lines	Patch %	Lines
bbot/modules/virtualhost.py	73%	120 Missing ⚠️
...est_step_2/module_tests/test_module_virtualhost.py	98%	12 Missing ⚠️

Additional details and impacted files

@@                      Coverage Diff                      @@
##           blasthttp-integration-clean   #2993     +/-   ##
=============================================================
- Coverage                           91%     91%     -0%     
=============================================================
  Files                              443     442      -1     
  Lines                            37927   38990   +1063     
=============================================================
+ Hits                             34316   35129    +813     
- Misses                            3611    3861    +250     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.