Methodology

When a web server hosts multiple websites on the same IP address, it uses **Virtual Hosting** to decide which site to serve when a request comes in. In HTTP/1.1 and above, every request must contain a `Host` header:

GET / HTTP/1.1
Host: example.com

This header tells the server which domain the client is trying to reach. * If the server only has one site: The `Host` header is often ignored or set to a default. * If the server has multiple virtual hosts: The web server uses the `Host` header to route the request internally to the right content. Suppose the server is configured like:

<VirtualHost *:80>
    ServerName site-a.com
    DocumentRoot /var/www/a
</VirtualHost>

<VirtualHost *:80>
    ServerName site-b.com
    DocumentRoot /var/www/b
</VirtualHost>

A request with the default host ("site-a.com") returns the content for Site A.

GET / HTTP/1.1
Host: site-a.com

A request with an altered host ("site-b.com") returns content for Site B (possibly revealing something new).

GET / HTTP/1.1
Host: site-b.com

Source: Virtual Hosts/README.md in PayloadsAllTheThings. From PayloadsAllTheThings by Swissky and contributors. MIT License, Copyright (c) 2019 Swissky.