Recon
Group hosts by favicon hash and pivot with Shodan
Hash favicons across a URL list and match them against a fingerprint dictionary.
overview
What favfreak does
favfreak reads a URLs file from stdin, fetches each favicon.ico, computes MurmurHash3, and groups hosts by hash against a bundled fingerprint dictionary.
Enable --shodan to emit http.favicon.hash dorks. Paste those into Shodan to find other hosts serving the same icon and widen scope past the original list.
Trickest runs it as a managed recon node after httpx or similar probing. Prefer favup when you need the origin IP behind one CDN-fronted host instead of clustering a list.
use cases
Where favfreak fits
Fingerprint tech by favicon
Hash the favicon of every URL in a list to group hosts by the software and framework behind them, surfacing the stack without active fingerprinting.
Generate Shodan dorks for pivoting
Turn computed favicon hashes into http.favicon.hash dorks with --shodan, then search Shodan for other hosts serving the same icon to widen the asset map.
Cluster an organization's assets
Group hosts that share a favicon to map an organization's properties, which helps scope an engagement or spot shadow assets that reuse a known icon.
Triage a probed surface
Run it after httpx to attach a tech label to each live host, so later stages focus on the stacks worth testing instead of the whole list.
reference
favfreak inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| urls | FILE | · | URLs to scan; the favicon.ico of each is fetched and hashed. |
| shodan | BOOLEAN | --shodan | Generate Shodan dorks (http.favicon.hash) from the computed hashes. |
Showing key inputs. favfreak exposes 2 inputs in total.
example
Run favfreak
# hash every favicon in a URL list and emit Shodan dorkscat urls.txt | favfreak --shodan[ 116323821 ] http://example.com http://www.example.com[ -1968997567 ] http://app.example.com[ 81586312 ] http://staging.example.com[ Shodan Dorks ]http.favicon.hash:116323821http.favicon.hash:81586312guidance
Choosing favfreak
Fingerprint a live URL list by favicon hash and optionally emit Shodan dorks. Run after discovery and probing. Use favup to unmask a single CDN origin.
favup
Resolves the real IP behind a favicon via Shodan. favfreak fingerprints tech and builds dorks across a list.
httpx
Probes hosts and detects technologies per request. favfreak adds favicon-hash grouping and Shodan pivoting.
wappalyzer
Detects web technologies from page content. favfreak uses the favicon hash as the fingerprint signal instead.
faq
favfreak questions
related
More Recon tools
amass
Multi-source subdomain discovery; hand names to httpx.
amass-intel
OWASP Amass intel: map an organization's root domains and ranges.
assetfinder
Find domains and subdomains potentially related to a given domain.
bbot
Modular OSINT recon that chains modules from a seed target.
bevigil
CLI client for the BeVigil OSINT API, keyed by domain or app package.
cloud-enum
Multi-cloud public name enumeration for AWS, Azure, and GCP.
Run favfreak yourself
A URL list feeds favfreak, which hashes each favicon, matches the fingerprint dictionary, and writes the grouped tech results as output.
Facts on this page come from the live Trickest tool library.