Finding Hidden Vhosts

During a recent test we observed a number of web servers that had a number vhosts configured, only some of which were discoverable from public DNS records.
During a recent test we observed a number of web servers that had a number vhosts configured, only some of which were discoverable from public DNS records.