Retrieve Favicon information

Enter the URL (must start with https:// or http://) in the box below, and hit enter. We will retrieve the Favicon information for you. Currently we display the MD5, SHA1, SHA256 and the MMH3 (Murmur) checksums.
URL:

Online Favicon checksum tool – MMH3, MD5 and more

Use our Favicon checksum tool to retrieve the checksums from the URL or Domain you have provided. Our tool will grab the Favicon from the site, parse it and provide back the MD5, SHA1, MMH3 and SHA256 checksum of the favicon.

Example result of the Favicon checksum tool

I have set a delay on the tool so it cannot be abused.

Reza Rafati

What is an Favicon

You actually see a favicon much more often than you think. A favicon is the icon that you see in the tabs of your browser. Often the favicon is the logo of the company whose website you are visiting. Every website has its own favicon.

Favicon overview

Threat hunting with Favicons

You can perform threat hunting activities for your clients or your own by collecting the hashes of the favicons you or your client owns. Favicons are often created once in a while and this means that most of them are actually quite static.

Cybercriminals which try to perform phishing attacks by copying your content often include the official Favicon of the copied website. It is for this reason, that a lot of threat hunting search engines have included the possibility to scan for the checksums of Favicons.

Identifying systems which are open to the web

There are some public archives which have collected the MM3H checksum of the favicons. These MM3H checksums can be used in search engines like Shodan to identify systems which are open to the web. One of them has collected favicons of systems that are often used in company infrastructures.

Screenshot of an MMH3 checksum archive

How to generate an MM3H checksum from an Favicon file

I like to share info, I am using this short Python code to generate the MM3H checksums from files. I used the Facebook MM3H favicon checksum as a check (-1289512924).

Code

The code below is Python code which should work on Python2 and certainly works on Python3. You do need the MMH3 library for this. The download link to that library can be seen below.


def get_mmh3(filepath): #with love from cyberwarzone.com
    import mmh3,base64
    with open(filepath, "rb") as image_file:
        encoded_string = image_file.read().encode("base64")
        favicon = encoded_string
        hash = mmh3.hash(favicon)
    return(str(hash))

The code above uses the following library:

  • MMH3 library for Python – Link
Share this information