FavFreak: A Penetration Testing Tool for Favicon Analysis and Subdomain Enumeration [Cheat Sheet]

1 year ago 90

BOOK THIS SPACE FOR AD

ARTICLE AD

FavFreak is a tool used in penetration testing and bug bounty hunting to analyze a website’s favicon (short for “favorite icon”). Favicons are small icons typically displayed in the browser’s address bar or next to the page title in the browser tab.

FavFreak can be used to:

Obtain the SHA1 hash of a website’s faviconPerform subdomain discovery based on a favicon hashSearch for other websites that use the same faviconExtract metadata from a website’s favicon, including image dimensions, format, and creation dateTake screenshots of a website and save them to a local directory

By analyzing the favicon of a website, FavFreak can help a penetration tester or bug bounty hunter identify subdomains, potential attack vectors, and other useful information about the target. FavFreak is a useful addition to any reconnaissance or enumeration toolkit.

Here are some example commands for FavFreak:

To find the favicon hash for a single website:

favfreak -u https://example.com

To find the favicon hash for a list of websites in a file:

favfreak -l /path/to/file.txt

To perform a subdomain search based on a favicon hash:

favfreak -f <hash> --subdomains

To extract metadata from a favicon:

favfreak -u https://example.com -e

To take screenshots of a website and save them to a directory:

favfreak -u https://example.com --screenshots /path/to/screenshots/

To search for websites with the same favicon hash as a target website:

favfreak -u https://example.com -s

To perform a search for favicons on a target website and save the results to a file:

favfreak -u https://example.com --search --output /path/to/output/file.txt

These are just a few examples of the commands that can be used with FavFreak. For a complete list of available options, you can run favfreak --help in your terminal.

For more information about this tools, you can visit this github.

Read Entire Article