Introducing FaviconLocator: The Eazy Button to Searching by Favicon

 

Favicons (short for favorite icons) are the cute little pixelated images that appear next to the site name in web browser tabs, bookmarks, etc. In the image below we can see the iconic GitHub logo on their site and the KFC logo on a bucket of chicken on their site.

Originally, favicons were designed to add a touch of professionalism and branding, but for anyone who is like me and has over a dozen tabs open at any time, favicons are the only thing displayed and how I navigate tabs.

Most of us rely on favicons on a daily basis but many never think of them as a tool we can use in OSINT and CTI investigations. That’s what we’re doing to talk about here as well as introduce a new tool.

In addition to branding and aiding in navigation between tabs, favicons can serve as unique identifiers for websites. These unique identifiers can help us:

• Trace the online presence of organizations and discover obscure digital assets

• Map the online infrastructure of potential threats

• Potentially de-anonymize the true IP address of a site on the dark web

• A heck of a lot more!

Consider a scenario where security analysts are tasked with mapping the online presence of a suspicious organization. Traditional methods of looking up IP addresses and DNS information, historic who, etc, are effective, but many don’t think about using the Favicon. A skilled OSINT practitioner can compute the hashes of a favicon, and, using the correct search syntax on platforms like Shodan.io, zoomeye.org, and Censys.io, analysts can quickly uncover other web assets linked to the same favicon, revealing potentially hidden or unknown websites associated with the organization.

What hashes do you need to compute? How do you do it? What’s the correct search syntax on these sites?? Let’s look at a new tool called FaviconLocator that makes it extremely easy!

Locating favicon files on websites is the fundamental first step in leveraging FaviconLocator for digital investigations. Favicons are typically located in the root directory of a website, but they can also be found in subdirectories or be specified in the website's HTML code. To locate a favicon, I usually start by checking the standard location, which is "/favicon.ico" at the domain's root. For instance, for a website at www.kfc.com, the favicon is found by navigating to www.kfc.com/favicon.ico. This is by far the most common location, but not all websites use this standard naming convention or location.

In cases where the favicon is not in the root directory, inspecting the website’s HTML source code is necessary. This can be done by right-clicking on the webpage and selecting “View Page Source” or similar options, depending on the browser. Within the HTML code, look for a link element with a rel attribute of “icon” or “shortcut icon”. This element will contain the href attribute specifying the path to the favicon file. This path might be absolute, pointing directly to the favicon's URL, or relative, indicating its location relative to the webpage’s URL.  I had to look at over a dozen sites before I found a site that didn’t use the default favicon location but I finally found one, and was able to stick to the fast food theme, mcdonalds.com.

Now that we’ve covered how to find and download the favicon file, let's talk about the searching.

Shodan.io, search.censys.io, and zoomeye.org all index and catalog favicons, but in order to search these repositories, you have to obtain the hash of the favicon file you downloaded and hash it. Which hashing algorithm do you use? It depends.

Search.censys.io uses the popular md5 hashing algorithm. And once you’ve obtained the hash of the favicon, it’s as simple as typing that into the search box on the site.

While many of you have likely heard of md5, shodan.io, and zoomeye.org, use a hashing algorithm that is likely new to you, mmh3. MurmurHash3 (mmh3 for short) is an algorithm used for its speed and processing efficiency.

Once you have obtained the mmh3 hash, you can search shodan.io with the following syntax: http.favicon.hash:YOURHASHHERE. Here is an example:

The final site we’ll look at here that allows you to search for Favicons is zoomeye.org. Like Shodan, it also uses the mmh3 hashing algorithm but the search syntax is different: iconhash:”YOURHASHHERE”. Here is an example:

Now that we’ve talked about how to identify the favicon files and search these sites, let’s look at a new Python tool that makes hashing, and knowing the search syntax, super easy.

The tool is called FaviconLocator and can be downloaded here: https://github.com/ArgeliusLabs/FaviconLocator

You will need Python installed on your system and will likey need to run “pip install mmh3” before it’s first use to install the mmh3 hashing library used by shodan and zoomeye. Once you’ve downloaded the tool, just put any favicon files you downloaded in the same directory and run the tool. It will ask you the name of the favicon file (including the extension) you would like to hash. It will then instantly provide you with the correct hashes, and make it even easier by providing you the search syntax for shodan, zoomeye and censys making your searches copy and paste easy.

Hopefully this tool makes it easy to incorporate favicon searches into your investigations! If you find anything interesting with it, I’d love to hear about it in the comments below!