Listen to this Post
Favicon hashing is a technique used in bug bounty hunting and penetration testing to identify web technologies, frameworks, or content management systems (CMS) by analyzing the favicon’s hash. Attackers and security researchers leverage this method to fingerprint websites and uncover potential vulnerabilities.
How Favicon Hashing Works
Favicons are small icons associated with websites, usually named favicon.ico. The hash of a favicon can be calculated and matched against known hashes in databases to identify specific software versions or frameworks.
Calculating Favicon Hash
Here’s how to compute a favicon hash using Python:
import mmh3
import requests
import codecs
def get_favicon_hash(url):
response = requests.get(url)
favicon = codecs.encode(response.content, "base64")
return mmh3.hash(favicon)
favicon_url = "http://example.com/favicon.ico"
print(f"Favicon Hash: {get_favicon_hash(favicon_url)}")
Using Favicon Hashes in Reconnaissance
Security researchers use tools like Shodan or Censys to search for websites with specific favicon hashes. For example:
shodan search http.favicon.hash:123456789
You Should Know:
- Common Favicon Hashes:
- WordPress: `-1744343670`
- Apache Tomcat: `-692947551`
- Jenkins: `-123456789` (example)
-
Automating with cURL & Bash:
curl -s http://target.com/favicon.ico | mmh3
-
Using FFUF for Favicon-Based Discovery:
ffuf -u "https://target.com/FUZZ" -w wordlist.txt -mr "favicon-hash"
-
Detecting Exposed Admin Panels:
nmap -p 80,443 --script http-favicon target.com
What Undercode Say
Favicon hashing is a powerful yet underutilized technique in bug bounty hunting. By automating hash checks, security professionals can quickly identify vulnerable systems. Combining this with tools like Nmap, Shodan, and Metasploit enhances reconnaissance efficiency.
Expected Output:
[/bash]
Favicon Hash: -1744343670
Shodan Results: 250 WordPress sites found
[bash]
Prediction
As web fingerprinting evolves, favicon hashing will become more automated, integrating directly into recon tools like Amass and theHarvester, making it a standard step in bug bounty workflows.
(Note: Telegram/WhatsApp links and unrelated comments were removed as per request.)
References:
Reported By: Salik Seraj – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
