Adding some Automation to the favicon.ico method of Host Recon, (Mon, Jun 29th)

Sicherheitsmeldung mit Schweregrad noch nicht bewertet. Technische Details im Tab „Originaltext“; empfohlene Schritte in der Checkliste.

Originaltext der Quelle (nicht übersetzt) – die deutsche Zusammenfassung findest du im Tab „Kurzfassung".

I'm in the throes of target host recon for another pentest, and thought I'd share some workflow / automation stuff. In the past, I've discussed using historic DNS "mining" to collect target hosts in the domain.

I thought I'd share some work on using the favicon.ico methods to expand on that.  Jan has an excellent diary on this here: https://isc.sans.edu/diary/27326 The "favicon.ico" file is the 16x16 pixel icon that shows up in the tab view for any particular host.  The trick here is that many organizations mandate the same file for all of their hosts, which means that you can often find hosts that should be in the scope of your engagement, but don't show up elsewhere.

To get the favicons.ico hash value from a site, this one liner is the way to go for me (windows CMD version shown):

rem FAV.CMD rem extract favicons.ico hash value from target website @echo off curl -sL https://%1/favicon.ico | python -c "import sys, base64, mmh3; print(mmh3.hash(base64.encodebytes(sys.stdin.buffer.read())))"

Let's look for a decent target.  Normally I'd pick sans.org, but it looks like SANS (intentionally I am sure) uses different favicon.ico files across their sites, they have multiple brands, plus they're wise to this recon method.  So, let's run this for some other domain, let's choose www.canada.ca:

fav www.canada.ca -1830416802

Now, we want to query shodan to find other hosts with this hash value, so from the web interface you would use "http.havicon.hash:-1830416802"

This gives us an unwieldy list of hundreds of hosts, organized by IP address but with a myriad of info for each …

Vollständiger Originalartikel ↗

• Betroffenheit im eigenen Stack prüfen: Versionen/Komponenten abgleichen.
• Originalquelle / Hersteller-Advisory lesen: https://isc.sans.edu/diary/rss/33110
• Verfügbaren Patch oder Workaround einspielen und dokumentieren.