favirecon is a Go utility that fingerprints web technologies, WAFs, exposed panels, and known services by hashing target favicons, built for authorized reconnaissance and bug bounty workflows.
| Tool | edoardottt/favirecon — favicon-hash based service and technology fingerprinter written in Go |
| Category | Reconnaissance / web fingerprinting |
| Primary Use | Quickly identifying technologies, WAFs, exposed panels, and known services across domains, lists, or CIDR ranges during authorized recon |
| Safe Use | Intended for authorized penetration tests, bug bounty programs with defined scope, and internal asset inventory assessments |
| Telemetry Note | Each scan causes a straightforward HTTP fetch of /favicon.ico from the target; defenders can correlate clusters of favicon requests from a single source as enumeration activity |
favirecon from edoardottt is a command-line fingerprinting tool built on a deceptively simple observation: the favicon a web service serves is frequently a unique, stable artifact of the software stack behind it. Default installs of frameworks, admin panels, firewalls, and appliances ship with their own icon files, and even when the HTML body is customized, operators rarely replace the favicon. By computing a hash of each target's favicon and matching it against a curated database of hash-to-service associations, favirecon converts a single cheap HTTP request into a technology identification signal. The repository describes its core purpose as using favicons to improve the target recon phase, quickly detecting technologies, WAFs, exposed panels, and known services.
The implementation is written in Go, which shows in both the distribution model and the runtime characteristics. The project ships through three channels documented in the README: brew install favirecon for Homebrew users, sudo snap install favirecon for Snap-based systems, and go install github.com/edoardottt/favirecon/cmd/favirecon@latest for anyone with a Go toolchain. That breadth of packaging, combined with continuous integration badges from GitHub Actions running a go.yml workflow, signals a maintained project rather than a one-off script. The repository sits at roughly 250 stars and carries an extensive topic list spanning recon, bug-bounty, pentesting-tools, and favicon-hash, which tells you the intended audience is the offensive security and bug bounty community.
Internally, the tool's logic almost certainly mirrors the well-known technique popularized by Shodan and fofa: fetch the favicon.ico resource, hash it using the mmh3 hash of the base64-encoded response body, and look up that hash in a local mapping of known values. What distinguishes favirecon from rolling your own script is the bundled database. The README is explicit about this dependency, noting in a highlighted callout that the tool heavily relies on its favicon hash database and asking users to open issues for new hash-service associations or corrections to wrong ones. That crowd-sourced curation model is the real asset here; the hashing algorithm is trivial, but a database of hundreds of validated mappings is not, and it improves with every community contribution.
The input interface is deliberately flexible for enumeration-heavy workflows. You can pass a single URL with -u or -url, feed a file of targets with -l or -list, or interpret input as a network range with the -cidr flag. The README's examples emphasize that protocols are needed when supplying lists, so targets.txt entries must include their http:// or https:// scheme rather than bare hostnames. Stdin piping is supported throughout, which matters for chain-oriented operators: cat targets.txt | favirecon slots cleanly after subdomain enumeration tools, meaning the output of something like a subdiscovery pass can be piped directly in without intermediate files.
A representative invocation from the documentation is favirecon -u https://www.github.com, and the same result can be produced with echo https://www.github.com | favirecon. For bulk work, favirecon -l targets.txt processes the full list. The CIDR mode, demonstrated as favirecon -u 192.168.1.0/24 -cidr, expands an address block into individual host checks, which is primarily useful for internal asset discovery during authorized internal assessments rather than spraying arbitrary internet ranges.
One of the more interesting flags is -hash, which inverts the tool's normal query direction. Instead of asking what service a target runs, cat targets.txt | favirecon -hash 708578229 filters results to only those targets matching a specific favicon hash. This turns favirecon into a triage instrument: if you know a particular exposed panel or appliance has a distinctive hash, you can sweep an entire target list for every instance of it. In a bug bounty context this is how you find forgotten management interfaces across a wide-scope program; in a defensive context the same capability is exactly how an external asset inventory audit would locate unmanaged, default-installed services.
Operational tuning is handled through a compact set of configuration flags. Concurrency defaults to 50 via -c or -concurrency, connection timeout defaults to 10 seconds via -t, and -rl or -rate-limit caps requests per second. Proxy support is available through -px, demonstrated in the README as -px http://127.0.0.1:8080, the canonical pattern for routing traffic through Burp Suite or similar intercepting proxies so operators can inspect exactly what the tool transmits. The rate limiter deserves mention because responsible scanning against third-party infrastructure, even in-scope bug bounty targets, means not hammering origin servers; the flag exists precisely to keep enumeration polite.
Output handling covers the usual operator needs: -o writes results to a file, -v enables verbose output, -s silences everything except results for clean piping, and -j emits structured JSON. The JSON mode is the integration point worth highlighting, because it lets favirecon become a stage in a larger pipeline where machine-readable results feed into deduplication, tagging, or reporting tooling. For professional engagements that culminate in a written deliverable, structured output is the difference between a tool you use and a tool you build around.
From an authorized workflow perspective, favirecon occupies the fingerprinting slot between subdomain enumeration and content discovery. It answers the question of what is running before you invest in deeper interaction with a target, which both saves time and reduces the footprint of your assessment. Because it makes a minimal number of requests per host, essentially just the favicon fetch, it is one of the least intrusive identification methods available. Penetration testers working scoped engagements, bug bounty hunters operating inside program rules, and blue teams auditing their own external attack surface all get value from the same capability.
Defenders should also understand the telemetry this activity produces. Every favirecon scan manifests as HTTP requests for /favicon.ico originating rapidly from one source across many destinations, often at the default concurrency of 50. That request pattern is distinct from organic browser traffic, where favicon fetches accompany full page loads, and can be flagged in SIEM correlation rules as low-and-slow enumeration. Clusters of favicon-only requests, especially against hosts that serve no other content to that source, are a reliable indicator of reconnaissance regardless of which favicon-hashing tool generated them.
The project's hygiene is solid for its size: an MIT license, documented contribution guidelines requiring golangci-lint run to pass before pull requests, release-note-driven changelogs, and visibility in community outlets like the Hive Five Newsletter by Securibee. The maintainer, edoardottt, is contactable through edoardottt.com, and the README actively solicits database corrections, which is the healthiest signal for a hash-mapping tool whose accuracy decays as software vendors update their icons. Prospective users should verify the database freshness against their target stack before relying on results as authoritative, treating mismatches as an invitation to open an upstream issue rather than a tool failure.
In summary, favirecon is a focused, well-packaged utility that extracts disproportionate intelligence from the smallest asset a web server exposes. Its value proposition rests on the curated hash database rather than novel engineering, its flag set covers the concurrency, rate-limiting, proxy, and output concerns that matter in professional engagements, and its Go-based single-binary distribution makes it trivial to deploy in any assessment environment. For authorized operators looking to compress the recon phase and surface default-installed or forgotten services across large target sets, it is a tool that earns its place in the workflow.
edoardottt/favirecon.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.