{"id":13540012,"url":"https://github.com/pielco11/fav-up","last_synced_at":"2025-05-14T20:04:21.441Z","repository":{"id":44163983,"uuid":"211358307","full_name":"pielco11/fav-up","owner":"pielco11","description":"IP lookup by favicon using Shodan","archived":false,"fork":false,"pushed_at":"2025-02-05T05:20:00.000Z","size":43,"stargazers_count":1159,"open_issues_count":2,"forks_count":144,"subscribers_count":23,"default_branch":"master","last_synced_at":"2025-04-14T11:09:55.378Z","etag":null,"topics":["cloudflare","cloudflare-bypass","favicon-icon","lookup","lookup-ip","murmur3","osint","phising","shodan","shodan-api"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/pielco11.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2019-09-27T16:17:27.000Z","updated_at":"2025-04-11T08:56:20.000Z","dependencies_parsed_at":"2023-02-09T10:31:43.654Z","dependency_job_id":"5b9891c3-8923-4bec-8d0b-5880715282fc","html_url":"https://github.com/pielco11/fav-up","commit_stats":null,"previous_names":[],"tags_count":2,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/pielco11%2Ffav-up","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/pielco11%2Ffav-up/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/pielco11%2Ffav-up/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/pielco11%2Ffav-up/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/pielco11","download_url":"https://codeload.github.com/pielco11/fav-up/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248868766,"owners_count":21174758,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cloudflare","cloudflare-bypass","favicon-icon","lookup","lookup-ip","murmur3","osint","phising","shodan","shodan-api"],"created_at":"2024-08-01T09:01:37.443Z","updated_at":"2025-04-14T11:10:17.388Z","avatar_url":"https://github.com/pielco11.png","language":"Python","funding_links":[],"categories":["\u003ca id=\"a76463feb91d09b3d024fae798b92be6\"\u003e\u003c/a\u003e侦察\u0026\u0026信息收集\u0026\u0026子域名发现与枚举\u0026\u0026OSINT","Python","Favicon search Tools","\u003ca id=\"170048b7d8668c50681c0ab1e92c679a\"\u003e\u003c/a\u003e工具"],"sub_categories":["\u003ca id=\"18c7c1df2e6ae5e9135dfa2e4eb1d4db\"\u003e\u003c/a\u003eShodan"],"readme":"# Fav-up\nLookups for real IP starting from the favicon icon and using Shodan.\n\n![img](https://i.imgur.com/ejPmx8T.png)\n![img2](https://i.imgur.com/7wf5AL7.png)\n\n# Installation\n- `pip3 install -r requirements.txt`\n- Shodan API key (**not** the free one)\n\n# Usage\n\n## CLI\nFirst define how you pass the API key:\n\n- `-k` or `--key` to pass the key to the stdin\n- `-kf` or `--key-file` to pass the filename which get the key from\n- `-sc` or `--shodan-cli` to get the key from Shodan CLI (if you initialized it)\n\nAs of now, this tool can be used in three different ways:\n\n- `-ff` or `--favicon-file`: you store locally a favicon icon which you want to lookup\n- `-fu` or `--favicon-url`: you don't store locally the favicon icon, but you know the exact url where it resides\n- `-w` or `--web`: you don't know the URL of the favicon icon, but you still know that's there\n- `-fh` or `--favicon-hash`: you know the hash and want to search the entire internet.\n\nYou can specify input files which may contain urls to domain, to favicon icons, or simply locations of locally stored icons:\n\n- `-fl`, `--favicon-list`: the file contains the full path of all the icons which you want to lookup\n- `-ul`, `--url-list`: the file contains the full URL of all the icons which you want to lookup\n- `-wl`, `--web-list`: the contains all the domains which you want to lookup\n\nYou can also save the results to a CSV/JSON file:\n\n- `-o`, `--output`: specify the output and the format, e.g.: `results.csv` will save to a CSV file (the type is automatically recognized by the extension of the output file)\n\n### Examples\n#### Favicon-file\n`python3 favUp.py --favicon-file favicon.ico -sc`\n\n#### Favicon-url\n`python3 favUp.py --favicon-url https://domain.behind.cloudflare/assets/favicon.ico -sc`\n\n#### Web\n`python3 favUp.py --web domain.behind.cloudflare -sc`\n\n\n## Module\n\n```python\nfrom favUp import FavUp\n\nf = FavUp()          \nf.shodanCLI = True\nf.web = \"domain.behind.cloudflare\"\nf.show = True \nf.run()\n\nfor result in f.faviconsList:\n    print(f\"Real-IP: {result['found_ips']}\")\n    print(f\"Hash: {result['favhash']}\")\n```\n\n### All attributes\n| Variable | Type |\n|-:|:-|\n| FavUp.show         | bool\n| FavUp.key          | str\n| FavUp.keyFile      | str\n| FavUp.shodanCLI    | bool\n| FavUp.faviconFile  | str\n| FavUp.faviconURL   | str\n| FavUp.web          | str\n| FavUp.shodan       | Shodan class\n| FavUp.faviconsList | list[dict]\n\n`FavUp.faviconsList` stores all the results, the key fields depend by the type of the lookup you want to do.\n\nIn case of `--favicon-file` or `--favicon-list`:\n\n- `favhash` stores the hash of the favicon icon\n- `file` stores the path\n\nIn case of `--favicon-url` or `--url-list`:\n\n- `favhash` stores the hash of the favicon icon\n- `url` stores the URL of the favicon icon\n- `domain` stores the domain name\n- `maskIP` stores the \"fake\" IP (e.g. the Cloudflare one)\n- `maskISP` store the ISP name associated to the `maskIP`\n\nIn case of `--web` or `--web-list`:\n\n- `favhash` stores the hash of the favicon icon\n- `domain` stores the domain name\n- `maskIP` stores the \"fake\" IP (e.g. the Cloudflare one)\n- `maskISP` store the ISP name associated to the `maskIP`\n\n(in this case the URL of the favicon icon is returned by the `href` attribute of `\u003clink rel='icon'\u003e` HTML element)\n\nIf, while searching for the favicon icon, nothing useful is found, `not-found` will be returned.\n\nIn all three cases, `found_ips` field is added for every checked entry. If no IP(s) have been found, `not-found` will be returned.\n\n# Compatibility\nAt least `python3.6` is required due to spicy syntax.\n\n# Feedback/Suggestion\nFeel free to open any issue, your feedback and suggestions are always welcome \u003c3\n\n# Publications\n\n[Unveiling IPs behind Cloudflare](https://pielco11.ovh/posts/cloud-hunting/) by [@noneprivacy](https://twitter.com/noneprivacy)\n\n# Disclaimer \nThis tool is for educational purposes only. The authors and contributors don't take any responsibility for the misuse of this tool. Use It At Your Own Risk! \n\n# Credits\n\nConceived by Francesco Poldi [noneprivacy](https://twitter.com/noneprivacy), build with Aan Wahyu [Petruknisme](https://twitter.com/petruknisme)\n\n[stanley_HAL](https://twitter.com/stanley_HAL) told me how Shodan calculates the favicon hash.\n\n[What is Murmur3?](https://www.sderosiaux.com/articles/2017/08/26/the-murmur3-hash-function--hashtables-bloom-filters-hyperloglog/)\n\n[More about Murmur3 and Shodan](https://www.cnblogs.com/miaodaren/p/9177379.html)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fpielco11%2Ffav-up","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fpielco11%2Ffav-up","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fpielco11%2Ffav-up/lists"}