loading
Loading content
loading
Recon
Hash favicons across a URL list and match them against a fingerprint dictionary.
overview
favfreak reads a list of URLs from a file, fetches each site's favicon.ico, computes its MurmurHash3 value, and matches that hash against a dictionary of known favicon fingerprints. Because a favicon hash often pins down the software, framework, or service behind a page, this turns a flat URL list into a grouped view of what is running where.
The same hashes power asset discovery. Hosts that share a favicon usually belong to the same organization or stack, so favfreak groups them by hash and, with --shodan, emits an http.favicon.hash dork for each one. Paste those dorks into Shodan to pivot from one icon to every host serving it across the internet.
On Trickest, favfreak is a Recon node that takes a URLs file and writes a folder of results. Run it after subdomain discovery and probing to fingerprint the surface by favicon, then use the Shodan dorks to widen scope to related assets.
use cases
Hash the favicon of every URL in a list to group hosts by the software and framework behind them, surfacing the stack without active fingerprinting.
Turn computed favicon hashes into http.favicon.hash dorks with --shodan, then search Shodan for other hosts serving the same icon to widen the asset map.
Group hosts that share a favicon to map an organization's properties, which helps scope an engagement or spot shadow assets that reuse a known icon.
Run it after httpx to attach a tech label to each live host, so later stages focus on the stacks worth testing instead of the whole list.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| urls | FILE | · | URLs to scan; the favicon.ico of each is fetched and hashed. |
| shodan | BOOLEAN | --shodan | Generate Shodan dorks (http.favicon.hash) from the computed hashes. |
Showing key inputs. favfreak exposes 2 inputs in total.
example
# hash every favicon in a URL list and emit Shodan dorkscat urls.txt | favfreak --shodan[ 116323821 ] http://example.com http://www.example.com[ -1968997567 ] http://app.example.com[ 81586312 ] http://staging.example.com[ Shodan Dorks ]http.favicon.hash:116323821http.favicon.hash:81586312guidance
Use favfreak to fingerprint a URL list by favicon hash and pivot to related assets via Shodan dorks. For looking up the real IP behind a favicon, use favup. Run favfreak after discovery and probing have produced a live URL list.
Resolves the real IP behind a favicon via Shodan. favfreak instead fingerprints tech and builds dorks across a list.
Probes hosts and detects technologies per request. favfreak adds favicon-hash grouping and Shodan pivoting.
Detects web technologies from page content. favfreak uses the favicon hash as the fingerprint signal instead.
faq
related
Asynchronous DNS brute-force tool for fast subdomain enumeration.
OWASP Amass: network mapping and external asset discovery.
OWASP Amass intel: find an organization's root domains and ranges.
OWASP Amass enumeration that produces structured JSON output.
Find related domains and subdomains via shared Google Analytics IDs.
Find domains and subdomains potentially related to a given domain.
A URL list feeds favfreak, which hashes each favicon, matches the fingerprint dictionary, and writes the grouped tech results as output.
Facts on this page come from the live Trickest tool library.