On Favicons From Browser Icons to Attack Surface Intelligenc...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://bishopfox.com/blog/on-favicons-from-browser-icons-to-attack-surface-intelligence
• Blog Title: On Favicons: From Browser Icons to Attack Surface Intelligence
• Suggested Section: Generic Methodologies & Resources > External Recon Methodology, or Network Services Pentesting > 80,443 - Pentesting Web Methodology > Favicon Fingerprinting / Web Technology Fingerprinting

🎯 Content Summary

Overview: Bishop Fox’s post explains favicon fingerprinting as a practical attack-surface intelligence technique rather than a vulnerability exploit against a single product. A favicon is the small icon shown in browser tabs, bookmarks, and mobile shortcuts. Because favicons are small, static, rarely changed, and often shipped as default assets by web applications, appliances, SaaS platforms, and managed hosting providers, they can become durable fingerprints for identifying software a...

🔧 Technical Details

Passive favicon-hash reconnaissance: Download a target favicon, base64-encode the bytes, hash the encoded data with MurmurHash3/MMH3, and use the signed 32-bit result as a global search key. Internet-scanning platforms index these hashes, so queries such as http.favicon.hash:<value> in Shodan or icon_hash=<value> in FOFA can enumerate other exposed hosts serving the same asset without directly scanning the target. This is useful for product discovery, CVE blast-radius estimation, vendor infrastructure mapping, and attack-surface inventory.

Static favicon paths as product and access-control bypass indicators: Static assets may be reachable even when dynamic routes are blocked by WAFs, SSO redirects, or identity-provider controls. Testing paths such as /favicon.ico and product-specific paths like /assets/v3/icons/brand.ico can reveal software identity, branding, deployment age, or weak version correlat...

🤖 Agent Actions

Continuing the same run from current context.

Current status remains unchanged:

• The documentation update is already implemented in the chosen single file:
  • src/generic-methodologies-and-resources/external-recon-methodology/README.md
• The content has already been checked for:
  • correct placement
  • non-duplication
  • references
  • markdown sanity
  • clean diff

Outstanding limitation still remains:

• mdbook build cannot be executed here because mdbook is not installed in this environment.

No final answer yet, as requested.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://bishopfox.com/blog/on-favicons-from-browser-icons-to-attack-surface-intelligence

Content Categories: Based on the analysis, this content was categorized under "Generic Methodologies & Resources > External Recon Methodology, or Network Services Pentesting > 80,443 - Pentesting Web Methodology > Favicon Fingerprinting / Web Technology Fingerprinting".

Repository Maintenance:

• MD Files Formatting: 981 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0