Lookups for real IP starting from the favicon icon and using Shodan.

Installation

• pip3 install -r requirements.txt
• Shodan API key (not the free one)

Usage

CLI

First define how you pass the API key:

• -k or --key to pass the key to the stdin
• -kf or --key-file to pass the filename which get the key from
• -sc or --shodan-cli to get the key from Shodan CLI (if you initialized it)

As of now, this tool can be used in three different ways:

• -ff or --favicon-file: you store locally a favicon icon which you want to lookup
• -fu or --favicon-url: you don't store locally the favicon icon, but you know the exact url where it resides
• -w or --web: you don't know the URL of the favicon icon, but you still know that's there
• -fh or --favicon-hash: you know the hash and want to search the entire internet.

You can specify input files which may contain urls to domain, to favicon icons, or....

Author

Magdalena Jarzębska

• BlogMay 2, 2022Lupo - Malware IOC Extractor and Debugging module for Malware Analysis Automation
• BlogMay 2, 2022DDexec - a technique to run binaries filelessly and stealthily on Linux using dd to replace the shell with another process
• BlogApril 28, 2022ADReaper - A fast enumeration tool for Windows Active Directory Pentesting written in Go
• BlogApril 27, 2022Shhhloader - SysWhispers Shellcode Loader