fav-up

Fav-up Lookups for real IP starting from the favicon icon and using Shodan. Installation pip3 install -r requirements.txt Shodan API key not the free one Usage CLI First define how you pass the API key: -k or --key to pass the key to the stdin -kf or --key-file to pass the filename which get the...

httpdoom

HttpDoom - HTTP Attack surface analyser Validate large HTTP-based attack surfaces in a very fast and reliable way. Inspired by Aquatone. Installing You must have dotnet SDK at version 6+: $ dotnet pack -c Release -o nupkg $ dotnet tool install --global --add-source .\nupkg\ httpdoom.console...

CVE-2020-5902

CVE-2020-5902 Shodan http.favicon.hash:-335242539 "3992"...

C2

C2 via python generated favicon, read with powershell...

Searpy

🥀 Searpy 🔧 Batch search tool, can be used for collection and traceability Supports py2 and py3 1. Install git clone https://github.com/j3ers3/Searpy pip install -r requirements.txt Configure API and account in ./config.py python Searpy -h 2. Help Searpy Engine Tookit optional arguments: -h,...

MurMurHash

MurMurHash This little tool is to calculate a MurmurHash value of a favicon to hunt phishing websites on the Shodan platform. What is MurMurHash? MurmurHash is a non-cryptographic hash function suitable for general hash-based lookup. The name comes from two basic operations, multiply MU and rotat...

CVE-2022-26134

CVE-2022-26134 1. First run the shodan scripts to grabs all the ips python3 shodanscript.py -API yourapi -L limit -D "http.favicon.hash:-305179312 200" log.txt ex: python3 shodanscript.py -API xxxxxxx -L 10 -D "http.favicon.hash:-305179312 200" log.txt 2. For all valid ips : cat log.txt | httpx -...

FavFreak

FavFreak - Weaponizing favicon.ico for BugBounties , OSINT and what not Detailed Description about this can be found here : Read Blog here : https://medium.com/@Asm0d3us/weaponizing-favicon-ico-for-bugbounties-osint-and-what-not-ace3c214e139 Introduction I have created this tool for making my wor...

fav-up

Fav-up Recherche d'adresses IP réelles à partir de l'icône favicon et en utilisant Shodan. Installation pip3 install -r requirements.txt Clé API Shodan pas la gratuite Utilisation CLI Définissez d'abord comment vous transmettez la clé API : -k ou --key pour passer la clé via stdin -kf ou --key-fi...

SPIP BigUp Plugin - Remote Code Execution

SPIP before 4.3.2, 4.2.16, and 4.1.18 is vulnerable to a command injection issue. A remote and unauthenticated attacker can execute arbitrary operating system commands by sending a crafted multipart file upload HTTP request. id: CVE-2024-8517 info: name: SPIP BigUp Plugin - Remote Code Execution...

shodan-favicon-preimage

Генератор прообраза favicon для Shodan Создайте favicon, который даёт любой целевой хеш в Shodan Этот инструмент реализует метод полного перебора для генерации любого прообраза для алгоритма Shodan http.favicon.hash. Вы можете, например, сделать так, чтобы ваш сайт появлялся при поиске по...

vajra

An automated web hacking framework for web applications Table of Content About Vajra What is Vajra Key Feaures What Vajra does Installation Running with docker-compose Tools Used by Vajra Contributing License Future Plans/Under Development Credits Disclaimer FAQ Detailed insight about Vajra can b...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation of favicon handling in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Firefox

A maliciously crafted favicon could lead to a memory-out-of-control crash. This vulnerability affects Firefox versions earlier than 113...

CVE-2026-85613

OpenPanel before 2.3.0 contains a cross-site scripting vulnerability in the unauthenticated favicon proxy endpoint GET /misc/favicon that allows remote attackers to execute scripts by supplying an SVG file URL. Attackers can host malicious SVG files with embedded scripts that execute in the...

CVE-2026-85612 OpenPanel before 2.3.0 SSRF via favicon and og endpoints

OpenPanel before 2.3.0 contains an unauthenticated server-side request forgery vulnerability in the /misc/favicon and /misc/og endpoints that accept an attacker-supplied url parameter with insufficient validation. Attackers can force the API to fetch arbitrary internal hosts and cloud metadata...

CVE-2026-85613 OpenPanel before 2.3.0 Unauthenticated XSS via SVG Favicon Proxy

OpenPanel before 2.3.0 contains a cross-site scripting vulnerability in the unauthenticated favicon proxy endpoint GET /misc/favicon that allows remote attackers to execute scripts by supplying an SVG file URL. Attackers can host malicious SVG files with embedded scripts that execute in the...

CVE-2026-85612

OpenPanel before 2.3.0 contains an unauthenticated Server-Side Request Forgery (SSRF) vulnerability in the /misc/favicon and /misc/og endpoints. These endpoints accept an attacker-supplied url parameter with insufficient validation, allowing an attacker to force the API to fetch arbitrary interna...

CVE-2026-85613

OpenPanel before 2.3.0 is vulnerable to an unauthenticated cross-site scripting (XSS) flaw in the favicon proxy endpoint GET /misc/favicon . An attacker can supply a URL pointing to a malicious SVG file with embedded scripts; when a victim's browser loads the proxy, the script executes on the API...

EUVD-2026-71032

OpenPanel before 2.3.0 contains a cross-site scripting vulnerability in the unauthenticated favicon proxy endpoint GET /misc/favicon that allows remote attackers to execute scripts by supplying an SVG file URL. Attackers can host malicious SVG files with embedded scripts that execute in the...