Favicon hash recon expands pentest attack surface

29 June 2026 low vulnerability

Pentesters can leverage favicon.ico hash queries via Shodan API to discover hundreds of in-scope hosts that don't appear in traditional DNS reconnaissance.

A penetration testing workflow demonstrates how to automate discovery of target hosts by extracting favicon.ico hash values and querying Shodan's API for matching hosts. The technique exploits the common practice where organizations mandate identical favicon.ico files across their web properties. Using a Canada.ca example, the author extracted a favicon hash (-1830416802), queried Shodan, and processed the JSON output with jq to distill 363 unique hostnames from the results.

The workflow chains together curl, Python's mmh3 library for hash generation, Shodan API queries, and jq for JSON parsing to automate what would otherwise be manual reconnaissance. The discovered hostnames resolved to 373 IP addresses, which when scanned with masscan revealed 5,091 open TCP ports across the target surface. While the technique produces false positives and may include honeypots, it significantly expands the attack surface beyond what traditional DNS mining alone would reveal.

This methodology is particularly effective in cloud infrastructure environments where hostname-based targeting is critical. The author notes that organizations aware of this technique, like SANS, intentionally use different favicon files across their properties to frustrate this reconnaissance method.

Detection guidance

Favicon Hash Extraction and Shodan API Query for Recon Automation

ATT&CK T1595.002

Detects command-line usage of mmh3 favicon hashing combined with curl queries to Shodan's API, indicating automated favicon-hash based host discovery. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Favicon Hash Extraction and Shodan API Query
id: 869382f5-5382-58db-b1ea-119f7f3620a0
status: experimental
description: Detects process command lines combining favicon hashing (mmh3) with curl
  requests to Shodan's API, a pattern used to enumerate hosts sharing identical favicon.ico
  files for reconnaissance.
logsource:
  category: process_creation
  product: linux
detection:
  selection_hash:
    CommandLine|contains:
    - mmh3
    - favicon.ico
  selection_shodan:
    CommandLine|contains:
    - shodan.io/shodan/host/search
    - api.shodan.io
    - shodan host
  condition: selection_hash and selection_shodan
falsepositives:
- Legitimate security research or authorized penetration testing engagements using
  Shodan tooling
- Internal asset management scripts that fingerprint favicon files for inventory purposes
level: medium
tags:
- attack.t1595.002
- attack.reconnaissance
author: Vorant

Outbound Network Connection to Shodan API from Endpoint

ATT&CK T1595.002

Detects network connections from a host to Shodan's API endpoint, which may indicate automated reconnaissance such as favicon-hash based host discovery run from an internal workstation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Outbound Connection to Shodan API Endpoint
id: 07ab476f-cc57-5a4e-b77b-d762ed722570
status: experimental
description: Detects outbound network connections to Shodan's API service, which pentest
  and recon tooling use to query for hosts matching favicon hashes or other fingerprints.
  Unexpected on regular endpoints or servers.
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationHostname|contains:
    - api.shodan.io
    - shodan.io
    DestinationPort: 443
  filter:
    Image|endswith:
    - \chrome.exe
    - \firefox.exe
    - \msedge.exe
  condition: selection and not filter
falsepositives:
- Authorized security researchers or red team members browsing Shodan via web browser
- Threat intelligence platforms that integrate with Shodan API for enrichment
level: medium
tags:
- attack.t1595.002
- attack.reconnaissance
author: Vorant

Masscan Execution for Large-Scale Port Scanning

ATT&CK T1595.002

Detects execution of masscan, a high-speed port scanner commonly used after host discovery (e.g. via favicon-hash Shodan lookups) to enumerate open TCP ports across a large derived target list. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Masscan Process Execution
id: c72aac17-6559-54a2-bc99-763d58e4a256
status: experimental
description: Detects invocation of the masscan tool, frequently used in reconnaissance
  workflows to rapidly scan large numbers of IP addresses/ports derived from prior
  host discovery techniques such as favicon-hash based Shodan queries.
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith: /masscan
  args_selection:
    CommandLine|contains:
    - -p1-65535
    - --rate
    - -iL
  condition: selection and args_selection
falsepositives:
- Authorized vulnerability scanning or asset discovery performed by internal security
  teams
- Network engineers running masscan for legitimate inventory audits
level: medium
tags:
- attack.t1595.002
- attack.reconnaissance
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://isc.sans.edu/diary/rss/33110

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free