recon-favicon-fingerprint

Compute MurmurHash3 fingerprints of favicon files to identify web technologies.

Updated Jul 30, 2026

Search Tags:#security #reconnaissance #infrastructure #favicon #fingerprinting #shodan

Ready to run

npx skills add https://github.com/salmanabdurrahman/pi-pentest-agent --skill recon-favicon-fingerprint

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: recon-favicon-fingerprint
Source: https://github.com/salmanabdurrahman/pi-pentest-agent/tree/main/skills/recon-favicon-fingerprint
Command: npx skills add https://github.com/salmanabdurrahman/pi-pentest-agent --skill recon-favicon-fingerprint

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires mmh3.

What problem does it solve?

This skill solves the challenge of identifying hidden web infrastructure and technology stacks by leveraging the unique cryptographic fingerprints of favicon files.

Core Features & Use Cases

Technology Identification: Automatically detect software stacks like Grafana, Jenkins, or GitLab by matching favicon hashes against a curated database.
Infrastructure Discovery: Use favicon hashes to find related servers and subdomains across the internet via Shodan, FOFA, and Censys.
Use Case: A security researcher can identify multiple publicly exposed internal monitoring dashboards across a target's IP range by searching for the specific favicon hash associated with their Grafana deployment.

Quick Start

Use the recon-favicon-fingerprint skill to analyze the target URL and search for matching infrastructure across third-party databases.

Frequently Asked Questions about recon-favicon-fingerprint

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I find related internet-facing infrastructure using a favicon hash?▼

Favicon fingerprinting computes a MurmurHash3 hash of a website's favicon file to identify related internet-facing infrastructure by querying third-party databases. You can discover exposed subdomains and servers by matching these hashes against Shodan, FOFA, or Censys records.

What is favicon fingerprinting for technology stack enumeration?▼

Favicon fingerprinting for technology stack enumeration is a reconnaissance technique that identifies software like Grafana or Jenkins by calculating unique MurmurHash3 hashes of their favicon files. This allows security assessments to detect specific web technologies deployed across target IP ranges.

Can I use favicon hashes to find publicly exposed internal monitoring dashboards?▼

You can use favicon hashes to find publicly exposed internal monitoring dashboards by searching infrastructure databases for the specific MurmurHash3 hash associated with the deployment. This passive reconnaissance method identifies exposed assets without directly scanning the target environment.

Do I need Shodan or Censys API access to compute favicon hashes?▼

You do not need Shodan or Censys API access to compute favicon hashes locally, as the MurmurHash3 calculation runs in your local Python environment. However, integrating with Shodan, FOFA, or Censys APIs is required to passively correlate these hashes and discover matching internet-facing infrastructure.

How do I identify web technologies like GitLab using favicon fingerprints?▼

To identify web technologies like GitLab using favicon fingerprints, you compute the MurmurHash3 of the target's favicon file and match it against a curated database. This process detects specific software stacks during security assessments and asset discovery workflows.

What are the limitations of using favicon hashes for reconnaissance?▼

A limitation of using favicon hashes for reconnaissance is that identifying infrastructure relies entirely on the target retaining default or unmodified favicon files. Additionally, passive infrastructure correlation requires external API integration with Shodan, FOFA, or Censys, making the workflow dependent on those third-party data sources.