Enumerate virtual websites on IIS

[Malf Easance <malf_easance () usa net>]

Hello Fellow pentesters

I'm working on a blind test and found an IIS
server that is apparently running virtual 
hosting multiple websites on the same IP address

HTTP/1.0 is refused wants the format like:

HTTP/1.1 
host:
(I don't know the host sites by name)

Is there a way to get IIS to spill a list
of all the 'host:' entries.

I've tried DNS PTR lookups but it seems as
though multiple addresses are bound to the 
interface as well, so I'm not sure I got 
them all.

TIA,

Malf

____________________________________________________________________
Get free email and a permanent address at http://www.amexmail.com/?A=1

----------------------------------------------------------------------------
This list is provided by the SecurityFocus Security Intelligence Alert (SIA)
Service For more information on SecurityFocus' SIA service which
automatically alerts you to the latest security vulnerabilities please see:
https://alerts.securityfocus.com/