NewsPublished 29 Jun 2026

Adding some Automation to the favicon.ico method of Host Recon, (Mon, Jun 29th)

Source SANS ISC Handlers Diary

Description

I&&#x23;x26;&#x23;39;m in the throes of target host recon for another pentest, and thought I&&#x23;x26;&#x23;39;d share some workflow / automation stuff.

Impact

This method facilitates expanded host discovery during reconnaissance by identifying hosts sharing the same favicon.ico hash. It does not exploit a vulnerability or cause direct harm but can increase the attack surface visibility for an adversary. There is no indication of exploitation or compromise resulting from this technique itself.

Defensive guidance

No direct remediation is required as this is an information gathering technique rather than a vulnerability. Organizations wishing to reduce exposure could consider varying favicons across hosts or implementing monitoring to detect unusual reconnaissance activity. However, these are general recommendations and not specific mitigations mandated by a vendor advisory.

Summary

The technique involves extracting the hash of the favicon.ico file from a target website and using Shodan's API to find other hosts with the same favicon hash. Since many organizations use the same favicon across multiple hosts, this method can reveal additional hosts that may not be discovered through traditional DNS mining. The process is automated using scripts to query Shodan, parse JSON responses, and generate lists of hostnames and IP addresses for further scanning with tools like nmap and masscan. This approach enhances host reconnaissance during penetration testing engagements.

References

isc.sans.edu/diary/rss/33110 (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 29 Jun 2026, 12:06 UTC

References

Community reviews