loading
Loading content
loading
Recon
Hash favicons across a URL list and match them against a fingerprint dictionary.
overview
favfreak reads a URLs file from stdin, fetches each favicon.ico, computes MurmurHash3, and groups hosts by hash against a bundled fingerprint dictionary.
Enable --shodan to emit http.favicon.hash dorks. Paste those into Shodan to find other hosts serving the same icon and widen scope past the original list.
Trickest runs it as a managed recon node after httpx or similar probing. Prefer favup when you need the origin IP behind one CDN-fronted host instead of clustering a list.
use cases
Hash the favicon of every URL in a list to group hosts by the software and framework behind them, surfacing the stack without active fingerprinting.
Turn computed favicon hashes into http.favicon.hash dorks with --shodan, then search Shodan for other hosts serving the same icon to widen the asset map.
Group hosts that share a favicon to map an organization's properties, which helps scope an engagement or spot shadow assets that reuse a known icon.
Run it after httpx to attach a tech label to each live host, so later stages focus on the stacks worth testing instead of the whole list.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| urls | FILE | · | URLs to scan; the favicon.ico of each is fetched and hashed. |
| shodan | BOOLEAN | --shodan | Generate Shodan dorks (http.favicon.hash) from the computed hashes. |
Showing key inputs. favfreak exposes 2 inputs in total.
example
# hash every favicon in a URL list and emit Shodan dorkscat urls.txt | favfreak --shodan[ 116323821 ] http://example.com http://www.example.com[ -1968997567 ] http://app.example.com[ 81586312 ] http://staging.example.com[ Shodan Dorks ]http.favicon.hash:116323821http.favicon.hash:81586312guidance
Fingerprint a live URL list by favicon hash and optionally emit Shodan dorks. Run after discovery and probing. Use favup to unmask a single CDN origin.
Resolves the real IP behind a favicon via Shodan. favfreak fingerprints tech and builds dorks across a list.
Probes hosts and detects technologies per request. favfreak adds favicon-hash grouping and Shodan pivoting.
Detects web technologies from page content. favfreak uses the favicon hash as the fingerprint signal instead.
faq
related
Multi-source subdomain discovery; hand names to httpx.
Find domains and subdomains potentially related to a given domain.
CLI client for the BeVigil OSINT API, keyed by domain or app package.
Multi-cloud public name enumeration for AWS, Azure, and GCP.
List assets from multiple cloud providers in one inventory.
Active multi-technique DNS enumeration for assessments.
A URL list feeds favfreak, which hashes each favicon, matches the fingerprint dictionary, and writes the grouped tech results as output.
Facts on this page come from the live Trickest tool library.