Ippsec does a lot of hackthebox boxes walkthroughs and in many of them he edits the /etc/hosts file.

Sometimes he adds multiple hostnames to the same ip address and when he browses those hostnames he gets different webpages. Shouldn't all hostnames return the same webpage? Because my understanding(may be very wrong) is that the /etc/hosts file only links ip addresses to hostnames and so there is no need to do a DNS lookup. Can anybody help me?


1 Answer 1


Web servers see the host header (IE the website name) that the browser is attempting to contact. The host header is sent regardless of how the IP was resolved. A single web server can host multiple sites on a single IP and thus uses the host header to determine which site/content to respond with.

  • Oh i see. Thanks! May 7, 2020 at 23:54
  • Thanks. Saved some time for me.
    – Raju
    Feb 7, 2021 at 18:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .