Pivot on favicon hashes to find related hosts

Compute the mmh3 hash of a target’s favicon, then query internet scanners for every host serving the same icon, which often reveals forgotten or internal-facing copies of the app.

import mmh3, requests, codecs
d = requests.get("https://target/favicon.ico").content
print(mmh3.hash(codecs.encode(d,"base64")))

Search the hash.

# shodan
shodan search "http.favicon.hash:-1234567890"
# censys web UI: services.http.response.favicons.md5_hash

Pro note: favicon pivoting is excellent for finding admin panels, staging clones, and the same product across a company’s acquisitions. Combine with the HTML title and specific header values to narrow results to the exact org rather than the whole vendor userbase.