#
Virtual Host
#
Gobuster
gobuster vhost -u machine.htb -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt
#
FFUF
First figure out the response length of false positives.
curl -s -H "Host: nonexistent.example.com" http://example.com/ | wc -c
Bruteforce:
ffuf -c -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt -u http://example.com/ -H "Host: FUZZ.example.com" -fs <length_of_false_positive>