Question: I'm currently learning how to discover web applications running on a machine using port scanning, vhost bruteforcing and directory fuzzing. When it comes to port scanning, there is one thing I can't wrap my head around.

Let's say I have scanned all ports on a host and discovered a HTTP service exposed. To validate it's indeed HTTP, I would send a GET request to that port and examine the response:

```
$ telnet <IP> 8080
Trying <IP>...
Connected to <IP>.
Escape character is '^]'.
GET / HTTP/1.1

HTTP/1.1 200 OK
Content-Type: text/html
<snip...>

```

But even if it is HTTP, can I be sure there aren't any virtual hosts configured that require the HTTP Host header field for the request to reach them?

Answer: 
I will use another *principle* to answer your question: use more than one defence line in case one gets broken.

If you can be sure that your login protection is 100% secure, both ways are stricly equivalent: only users from TeamAlice can access machines from TeamAlice\_Computers and only those having the admin privilege can use `admin_command` there.

Now if `admin_command` is highly sensitive, I would use two security groups. The rationale is that a weakness in the login system allowing a user from TeamAlice to access a machine in TeamAlice\_Computers will not give them admin privileges. It should not be possible, but we all know that many softwares can have security flaws...
It depends. Each approach in this case has own pros and cons.

You don't describe how is the login permissions are given.

One approach can be to define 2 groups:

* "AliceAdmins": This group would contain permissions "AliceLogin" and "admin\_command"
* "BobAdmins": This group would contain permissions "BobLogin" and "admin\_command"

Thus you can configure each of these groups *independently* on each other. For instance, you can easily add some "admin\_command\_2" to one group but not to the other. Or you can easily remove "admin\_command" from one group but keep it in the other.