What is Favicon.ico Method in Host Recon for Phishing?

Favicon.ico Method in Host Recon for Phishing refers to a technique used by attackers to gather information about a target host by analyzing the unique hash values of favicon.ico files, which are often overlooked but highly distinctive to specific web applications or platforms.

Definition

The favicon.ico method is a host reconnaissance technique used in phishing campaigns to identify web technologies and software used by target domains through their unique favicon hash values.

Why It Matters

In the realm of phishing and social engineering, reconnaissance marks the first critical step in the attack lifecycle. By identifying and characterizing target infrastructure, attackers can tailor their phishing campaigns to exploit known vulnerabilities. The favicon.ico method is particularly valuable because favicons are unique to the platforms or applications serving them. This allows attackers to determine underlying technologies without direct interaction with the web server, providing a stealthy mechanism to refine targeting strategies.

These icons, typically found at the root of a website, are small image files displayed in a browser’s address bar or tab. However, their digital footprint—the hash of the favicon.ico file—can indicate what content management systems, frameworks, or specific software is in use. For attackers, this kind of insight offers a roadmap to intimate host configurations, which can be exploited in subsequent stages of a phishing campaign. For instance, knowing if a site uses WordPress allows phishing lures that specifically aim to extract WordPress admin credentials.

In Practice

Consider a scenario where a target organization uses a widely known content management system like WordPress. An attacker leverages a reconnaissance tool that collects favicon.ico files across multiple subsystems of the target domain. They run these files through a hash function to produce values corresponding to known favicon signatures linked to WordPress. Thus, without even probing for WordPress installation directly, the attacker confirms the technology stack in use.

In a documented phishing case, attackers sent emails claiming to be from ‘IT Support’, promising an urgent update. The email contained a link to a cloned WordPress login page. Prior to crafting this lure, attackers had used the favicon.ico method to confirm WordPress installation, enabling this tailored and convincing attack vector.


GET /favicon.ico HTTP/1.1

Host: victim-organization.com

Connection: close



Hash (e.g., SHA256): dae9d03ef640ea3fad94ef... [truncated for brevity]



# Hash matches known signature for WordPress favicon

This method can extend beyond simple content management systems. If a healthcare provider’s patient portal utilizes a specific CRM or third-party service, attackers can pinpoint this by hashing and cross-referencing favicon.ico data. Such knowledge guides spear-phishing attempts to trick employees into granting access to patient records.

Related Terms

The favicon.ico method is closely related to terms such as Directory Traversal and Host Fingerprinting. Understanding these processes enhances the reconnaissance capability by allowing a more comprehensive mapping of target systems’ internal structures and services.

References

ISC SANS Diary – The Favicon.ico Detection Technique

CSO Online – What is Footprinting?