FavInfo

Fast favicon reconnaissance tool for extracting, hashing, and analyzing website favicons with Shodan, FOFA, Censys, ZoomEye, and Quake query generation.

Supported Search Engines

• Shodan: http.favicon.hash:123456789
• FOFA: icon_hash="123456789"
• Censys: services.http.response.favicons.md5_hash="hash"
• ZoomEye: iconhash:123456789
• Quake: favicon.hash:123456789

Installation

go install github.com/rix4uni/favinfo@latest

Download prebuilt binaries

wget https://github.com/rix4uni/favinfo/releases/download/v0.0.9/favinfo-linux-amd64-0.0.9.tgz
tar -xvzf favinfo-linux-amd64-0.0.9.tgz
rm -rf favinfo-linux-amd64-0.0.9.tgz
mv favinfo ~/go/bin/favinfo

Or download binary release for your platform.

Compile from source

git clone --depth 1 https://github.com/rix4uni/favinfo.git
cd favinfo; go install

Usage

Usage of favinfo:
      --concurrent int       Number of URLs to process concurrently (default 50)
      --fingerprint string   Path to the fingerprint.json file (default: $HOME/.config/favinfo/fingerprint.json or ./fingerprint.json)
      --json                 Output results in JSON format
      --silent               Silent mode.
      --source               Enable source output for where the url coming from scraped or added /favicon.ico
      --timeout duration     Set the HTTP request timeout duration (default 30s)
      --user-agent string    Set the User-Agent header for HTTP requests (default "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36")
      --verbose              Verbose mode. Show verbose output.
      --version              Print the version of the tool and exit.

Usage Examples

Basic Usage

echo "https://www.google.com" | favinfo

Multiple URLs

cat subs.txt | favinfo

JSON Output

echo "https://www.google.com" | favinfo --json

Output Examples

Default Output

Input URL:    https://www.google.com
Shodan:       http.favicon.hash:540608765
Fofa:         icon_hash="540608765"
Censys:       services.http.response.favicons.md5_hash="e8972ce34a4545b33c3926a20c306b71"
ZoomEye:      iconhash:540608765
Quake:        favicon.hash:540608765

Verbose Output

Input URL:    https://www.google.com
Favicon URL:  https://www.gstatic.com/images/branding/searchlogo/ico/favicon.ico
MD5:          e8972ce34a4545b33c3926a20c306b71
SHA256:       8720df457a93b97d3cdd7c05714c8e255a1969085844eb247756b869dbea636a
Murmur3:      540608765
Technology:   unknown
Shodan:       http.favicon.hash:540608765
Fofa:         icon_hash="540608765"
Censys:       services.http.response.favicons.md5_hash="e8972ce34a4545b33c3926a20c306b71"
ZoomEye:      iconhash:540608765
Quake:        favicon.hash:540608765

JSON Output

{
  "input_url": "https://www.google.com",
  "favicon_url": "https://www.gstatic.com/images/branding/searchlogo/ico/favicon.ico",
  "murmur_hash": 540608765,
  "md5_hash": "e8972ce34a4545b33c3926a20c306b71",
  "sha256_hash": "8720df457a93b97d3cdd7c05714c8e255a1969085844eb247756b869dbea636a",
  "technology": "unknown",
  "search_queries": {
    "shodan": "http.favicon.hash:540608765",
    "fofa": "icon_hash=\"540608765\"",
    "censys": "services.http.response.favicons.md5_hash=\"e8972ce34a4545b33c3926a20c306b71\"",
    "zoomeye": "iconhash:540608765",
    "quake": "favicon.hash:540608765"
  }
}