Favicons are tiny icons used by modern web applications. When combined with search engines, they’re great pivots for discovering related internet assets.

This tool helps security practitioners find assets using favicon hashes across multiple search engines:

• Censys
• Criminal IP
• FOFA
• Hunter-How
• Netlas
• Odin
• Shodan
• Silent Push
• Validin
• VirusTotal
• Zoomeye

pip install favihunter

# install pipx if you don’t have it
python3 -m pip install --user pipx
python3 -m pipx ensurepath  # then restart your shell

# install favihunter
pipx install favihunter

# upgrade later
pipx upgrade favihunter

# run without installing (one-shot)
pipx run favihunter --help

git clone https://github.com/eremit4/favihunter.git
cd favihunter
poetry install

Using a virtual environment is recommended to avoid dependency conflicts.

favihunter --url https://python.org

Favihunter downloads the favicon, computes hashes (MMH3, MD5, SHA256, and optional perceptual hash), and prints ready-to-click search URLs.

favihunter --help

Analyze a single URL:

favihunter --url <url>

Analyze a file with URLs (one per line):

favihunter --urls <file>

Analyze a local favicon file:

favihunter --favicon <path/to/favicon.ico>

Clean the temp folder:

favihunter --remove

VirusTotal pivot:

favihunter --url <url> --virus-total

✅ Requirements

• Python 3.8+
• Linux/macOS (Windows is likely fine via PowerShell; please open an issue if you hit problems)

pip

pip install --upgrade favihunter
pip uninstall favihunter

pipx

pipx upgrade favihunter
pipx uninstall favihunter