Automating Host Reconnaissance with Favicon Analysis in Phishing Campaigns

In the landscape of phishing campaigns, precise target selection is crucial for optimizing the likelihood of successful exploitation. Automating host reconnaissance with favicon.ico analysis offers a subtle yet strategic method for identifying and profiling potential targets. Unlike more conventional methods, favicon analysis exposes less obvious patterns that correlate with specific organizations or IT infrastructures.

Effective usage means understanding the nuances that differentiate successful campaigns from those caught in defensive nets. By integrating favicon.ico analysis into automated workflows, you efficiently sift through potential targets, allowing engagement focus to remain on high-probability compromises. Post-article, you’ll have enhanced techniques for identifying target architecture and prioritizing phishing engagements with precision.

Prerequisites and Setup

Before executing this technique, you need several tools and configurations set up in a controlled environment. First, ensure you have access to a Linux-based environment with Internet connectivity. You will use tools such as Shodan for internet-wide scanning and fav-up, a utility designed for inspecting and comparing favicon hashes across multiple domains. To install fav-up, use the following:


git clone https://github.com/devanshbatham/fav-up

cd fav-up

pip install -r requirements.txt

This code clones the fav-up repository and installs the necessary Python dependencies.

Another essential is a script or tool for mapping favicon hashes to known web applications or frameworks. Specialized scripts or downloading from open-source resources may be needed, depending on your specific targets.

Step-by-Step Execution

Identify Targets with Shodan

Begin by running Shodan scans to identify hosts serving favicons, focusing on organizational domain profiles. The following command is a starting point:


shodan download --limit 1000 --query "http.favicon.hash" targets.json.gz

This command retrieves potential hosts from Shodan with favicon hashes, limited to the first 1000 results for efficiency.

Extract and Analyze Favicon Data

Next, filter the relevant data from Shodan results to isolate favicon URLs. The extraction script might look like this:


zgrep '"http.favicon.hash"' targets.json.gz | jq -r '.ip_str, .http.favicon.hash' > favicons.txt

This extracts IP addresses and favicon hashes into a comprehensible format, ready for analysis.

Match Favicon Hashes to Known Applications

For matching, use the fav-up tool to compare hashes against known application signatures:


python fav-up.py --input favicons.txt --output matches.txt

This command runs fav-up creating a file,

matches.txt

, listing applications correlated with each favicon hash.

Advanced Variations

Variation 1: Multiple Hash Comparisons

For increased accuracy, expand your hash comparison to include custom hash libraries built from known organizational infrastructure. This approach leverages both open-source frameworks and proprietary insights, maximizing targeted specificity.


python fav-up.py --input favicons.txt --libs extended_hashes.json --output extended_matches.txt

This modification uses an extended library of hashes, broadening the correlation scope substantially.

Variation 2: Automated Workflow Integration

Integrate the favicon analysis pipeline into an automated workflow using cron scheduling and Slack notifications for real-time updates:


(crontab -l ; echo "0 * * * * /path/to/fav-up.py --input /path/to/favicons.txt --libs /path/to/extended_hashes.json --output /path/to/matches.txt | /path/to/send-to-slack.sh") | crontab -

This cron entry runs the favicon analysis hourly, pipelining results to a notification script for Slack.

Good / Better / Best

Good: Basic favicon analysis using public hash libraries. Retrieves relevant data but may miss organization-specific insights. Use the standard fav-up setup.
Better: Includes curated custom hash databases specific to targeted industries, ensuring that lesser-known or proprietary systems are isolated. Implement an expanded custom database as shown:


python fav-up.py --input favicons.txt --libs custom_hashes.json --output better_matches.txt

Using a custom hash database captures additional layers of infrastructure detail.

Best: Fully automated recognition integrated into broader reconnaissance workflows, utilizing API data for instant updates. You should run an automated system including all variations above.

Related Concepts

Beyond favicon analysis, understanding the organization’s technological ecosystem helps in crafting effective phishing campaigns. Open Source Intelligence (OSINT) and Subdomain Takeovers further enrich target profiling, ensuring operators can exploit unattended subdomains or uncover sensitive infrastructure leaks. By integrating these techniques, operators can extend their visibility beyond initial facades offered by typical organizational web presence.