Favicon Hash and Shodan Recon for Hidden Bug Bounty Assets
Favicons look like decoration, but search engines see bytes. Shodan indexes an HTTP favicon using a MurmurHash3 value, which lets you pivot from one known website to other hosts returning the same icon. On a good target, that search uncovers an old admin panel, a direct origin, or an acquisition nobody added to the asset inventory.
The technique starts with the exact icon Shodan hashed. Fetch the page, inspect its <link rel="icon"> element, and download that resource without converting it. Redirects, SVG fallbacks, and framework defaults matter. Shodan's familiar hash recipe base64-encodes the raw file with line wrapping before applying signed MurmurHash3. Hashing a browser screenshot or a resized PNG gives a useless number.
A short Python proof looks like this:
import base64, mmh3, requests
data = requests.get("https://example.com/favicon.ico", timeout=10).content
print(mmh3.hash(base64.encodebytes(data)))
Search Shodan for http.favicon.hash:<number>. Then narrow results with country, organization, ASN, port, product, or SSL filters. Save the original broad result count first; an over-tight filter can hide the one odd server you wanted.
A match is a lead, not ownership
This is where hunters get sloppy. Frameworks, hosting panels, white-label products, and default WordPress themes reuse icons across thousands of unrelated customers. Even a custom-looking logo may belong to a vendor. Never claim a host based on the hash alone.
Corroborate each candidate with two or three independent signals:
- A TLS certificate containing the target's domain or company name
- HTML titles, JavaScript chunks, analytics IDs, or copyright text matching the known app
- DNS history linking the IP to an in-scope hostname
- Response headers, cookies, and error pages with the same unusual fingerprint
- An ASN or cloud account pattern already associated with the target
Open only a few promising results and keep requests ordinary. Shodan already did the broad scanning; your job is validation, not repeating an internet-wide probe.
Useful pivots after the first hit
Suppose the search returns an IP on port 8443 with the target's branding. Check its certificate names and passive DNS. A name like legacy-admin.example.com may lead to more hosts through certificate transparency. If the IP also answers for the production Host header, you may have found a WAF origin. If it exposes an old login panel, compare its software version and authentication flow with current scope before testing.
Hash adjacent assets too. Product lines often use different icons for customer, staff, and partner portals. Mobile API documentation may carry another brand-specific favicon. Each distinct hash creates a separate cluster.
Write the report around impact
“This IP has the same favicon” is recon trivia. The report begins when the discovered asset creates security impact: an in-scope admin service omitted from the inventory, a vulnerable legacy version, exposed debug information, or direct access around edge controls. Document the hash, Shodan query, corroborating ownership evidence, and one safe proof of the actual weakness.
Do not paste a list of unrelated Shodan results into a ticket. Triage should be able to follow a short chain from known asset, to fingerprint, to owned host, to vulnerability. That chain is what turns a 16-pixel image into a bounty.