{"id":3904,"date":"2026-06-29T13:04:12","date_gmt":"2026-06-29T13:04:12","guid":{"rendered":"https:\/\/blog.ibvl.in\/index.php\/2026\/06\/29\/adding-some-automation-to-the-favicon-ico-method-of-host-recon-mon-jun-29th\/"},"modified":"2026-06-29T13:04:12","modified_gmt":"2026-06-29T13:04:12","slug":"adding-some-automation-to-the-favicon-ico-method-of-host-recon-mon-jun-29th","status":"publish","type":"post","link":"https:\/\/blog.ibvl.in\/index.php\/2026\/06\/29\/adding-some-automation-to-the-favicon-ico-method-of-host-recon-mon-jun-29th\/","title":{"rendered":"Adding some Automation to the favicon.ico method of Host Recon, (Mon, Jun 29th)"},"content":{"rendered":"<div>\n<p>I&#8217;m in the throes of target host recon for another pentest, and thought I&#8217;d share some workflow \/ automation stuff.<br \/>\nIn the past, I&#8217;ve discussed using historic DNS &#8220;mining&#8221; to collect target hosts in the domain.<\/p>\n<p>I thought I&#8217;d share some work on using the favicon.ico methods to expand on that.\u00a0 Jan has an excellent diary on this here: https:\/\/isc.sans.edu\/diary\/27326<br \/>\nThe &#8220;favicon.ico&#8221; file is the 16&#215;16 pixel icon that shows up in the tab view for any particular host.\u00a0 The trick here is that many organizations mandate the same file for all of their hosts, which means that you can often find hosts that should be in the scope of your engagement, but don&#8217;t show up elsewhere.<\/p>\n<p>To get the favicons.ico hash value from a site, this one liner is the way to go for me (windows CMD version shown):<\/p>\n<p style=\"margin-left: 40px;\"><span style=\"font-family:Courier New,Courier,monospace;\">rem FAV.CMD<br \/>\nrem extract favicons.ico hash value from target website<br \/>\n@echo off<br \/>\ncurl -sL https:\/\/%1\/favicon.ico | python -c &#8220;import sys, base64, mmh3; print(mmh3.hash(base64.encodebytes(sys.stdin.buffer.read())))&#8221;<\/span><\/p>\n<p>Let&#8217;s look for a decent target.\u00a0 Normally I&#8217;d pick sans.org, but it looks like SANS (intentionally I am sure) uses different favicon.ico files across their sites, they have multiple brands, plus they&#8217;re wise to this recon method.\u00a0 So, let&#8217;s run this for some other domain, let&#8217;s choose www.canada.ca:<\/p>\n<p style=\"margin-left: 40px;\"><span style=\"font-family:Courier New,Courier,monospace;\">fav www.canada.ca<br \/>\n-1830416802<\/span><\/p>\n<p>Now, we want to query shodan to find other hosts with this hash value, so from the web interface you would use &#8220;http.havicon.hash:-1830416802&#8221;<\/p>\n<p>This gives us an unwieldy list of hundreds of hosts, organized by IP address but with a myriad of info for each IP.\u00a0 What we really want in today&#8217;s cloud-infrastructure world is the list of hostnames &#8211; how do we get that?<\/p>\n<p>Let&#8217;s go to Shodan&#8217;s API, and query from there.\u00a0 Since we&#8217;re of course going to do this in a repeatable way for future engagements, let&#8217;s script this too:<\/p>\n<p style=\"margin-left: 40px;\"><span style=\"font-family:Courier New,Courier,monospace;\">rem SHODAN-FAV<br \/>\nrem search shodan.io for favicon.ico matches<br \/>\ncurl -s -k &#8220;https:\/\/api.shodan.io\/shodan\/host\/search?key=%APIKEY_SHODAN%&amp;query={http.favicon.hash:%1}<\/span><\/p>\n<p>So, for our value, this returns a HUGE file of 6MB, which I won&#8217;t show in it&#8217;s entirety here.\u00a0 A snip though, run through https:\/\/jsonvierwer.stack.hu (just because I find it a nice, readable output) is:<\/p>\n<p style=\"margin-left: 40px;\"><img decoding=\"async\" alt=\"\" src=\"https:\/\/isc.sans.edu\/diaryimages\/images\/json-format-1.png\" style=\"width: 270px; height: 395px;\"><\/p>\n<p>So in the output file, we want the &#8220;hostnames&#8221; arrays in a text list, suitable for nmap or any other tool that wants a list of hosts as input.\u00a0 We see the hosts in groups, numbered sequentially.<\/p>\n<p>So we want to pull the array values that are multiple levels &#8220;deep&#8221; in the structure, with arbitrary &#8220;parents&#8221; (in this case 0,1,2,3 &#8230;)<br \/>\nTo query at arbitrary \/ recursive depth, use the\u00a0 &#8220;..&#8221; query method in jq<\/p>\n<p>So, in our use case, it would be:<\/p>\n<p style=\"margin-left: 40px;\"><span style=\"font-family:Courier New,Courier,monospace;\">type fa.out | jq -r &#8220;.. | arrays[].hostnames?&#8221;\u00a0 | more<\/span><\/p>\n<p>Which gives us:<\/p>\n<p style=\"margin-left: 40px;\"><span style=\"font-family:Courier New,Courier,monospace;\">[<br \/>\n\u00a0 &#8220;www.cfc.forces.gc.ca&#8221;,<br \/>\n\u00a0 &#8220;www.cfc.dnd.ca&#8221;<br \/>\n]<br \/>\n[<br \/>\n\u00a0 &#8220;ip150.ip-51-79-10.net&#8221;,<br \/>\n\u00a0 &#8220;intercultures.ca&#8221;<br \/>\n]<br \/>\n[<br \/>\n\u00a0 &#8220;account-compte.ceba-cuec.ca&#8221;<br \/>\n]<br \/>\n[<\/span><br \/>\n.. and so on<\/p>\n<p>\nNext step is we need to distill this down to just a plain list of hostnames, so let&#8217;s delete those brackets, commas, spaces and quotes.\u00a0 We also have a number of &#8220;null&#8221; hostnames, let&#8217;s get rid of those:<\/p>\n<p style=\"margin-left: 40px;\"><span style=\"font-family:Courier New,Courier,monospace;\">cat fa.out | jq -r &#8220;.. | arrays[].hostnames?&#8221;\u00a0 | grep -v null | tr -d &#8220;,&#8221; []&#8221;\u00a0<\/span><\/p>\n<p>running it all through a standard sort \/ uniq filter gives us a final list:<\/p>\n<p style=\"margin-left: 40px;\"><span style=\"font-family:Courier New,Courier,monospace;\">cat fa.out | jq -r &#8220;.. | arrays[].hostnames?&#8221;\u00a0 | grep -v null | tr -d &#8220;,&#8221; []&#8221; | sort | uniq<br \/>\n8fb29c57162d4e1c.com<br \/>\n94-158-245-105.mivocloud.com<br \/>\naccount-compte.ceba-cuec.ca<br \/>\naccreditationcanada.gc.ca<br \/>\nacsta.ca<br \/>\nacsta-catsa.gc.ca<br \/>\nacsta.gc.ca<br \/>\nai-answers.alpha.canada.ca<br \/>\napostille.canada.ca<br \/>\nasc-csa.gc.ca<br \/>\naus.vet<br \/>\nautodiscover.rmc.ca<br \/>\nbanting.bourses-fellowships.gc.ca<\/span><\/p>\n<p style=\"margin-left: 40px;\">&#8230; and so on<\/p>\n<p>We can see a few false postives, also a number of hostnames that are duplicated later with a &#8220;www.&#8221; prefix, but for the most part we&#8217;re bang on!<\/p>\n<p>So what&#8217;s the final hostname count?<\/p>\n<p style=\"margin-left: 40px;\"><span style=\"font-family:Courier New,Courier,monospace;\">cat fa.out | jq -r &#8220;.. | arrays[].hostnames?&#8221;\u00a0 | grep -v null | tr -d &#8220;,&#8221; []&#8221; | sort | uniq | wc -l<br \/>\n363<\/span><\/p>\n<p>With a few manual edits, this gives us a sorted list of hostnames that we can use for nmap or whatever tool.\u00a0 For instance:<\/p>\n<p style=\"margin-left: 40px;\"><span style=\"font-family:Courier New,Courier,monospace;\">nmap -sT -p443 &#8211;open &#8211;resolve-all -iL fav.out<\/span><\/p>\n<p>Not surprisingly, this gives us a number of &#8220;could not resolve&#8221; errors right off the bat.\u00a0 Let&#8217;s get the list of all hostnames that failed to resolve (for our report):<\/p>\n<p style=\"margin-left: 40px;\"><span style=\"font-family:Courier New,Courier,monospace;\">nmap -sn &#8211;resolve-all -iL hosts.in | grep &#8220;failed to resolve&#8221;<\/span><\/p>\n<p>More to the point, let&#8217;s get the list of IP addresses of the hosts that resolve and return a reply for an icmp echo request:<\/p>\n<p style=\"margin-left: 40px;\"><span style=\"font-family:Courier New,Courier,monospace;\">cat nmap-out-1.gnmap | grep Up | cut -d &#8221; &#8221; -f 2 &gt; hostips.in<\/span><\/p>\n<p>So now we have 363 hostnames, which resolve out to 373 IP addressees.\u00a0 Not a great ratio, but I expect that many of these will end up being load balancers, and don&#8217;t forget the hostnames that have both &#8220;sitename.gc.ca&#8221; and &#8220;www.sitename.gc.ca&#8221; names.<\/p>\n<p>Now we can get a more useful list &#8211; find all of the open ports on all of the target hosts (using the IP addresses, not the fqdn hostnames).\u00a0 Be sure to do this immediately &#8211; you might find that some of these &#8211; especially things like api gateways and other cloud &#8220;service&#8221; targets &#8211; will change fairly frequently.\u00a0 Let&#8217;s pipe it in to masscan for a full list of tcp ports that are open in our target list:<\/p>\n<p style=\"margin-left: 40px;\"><span style=\"font-family:Courier New,Courier,monospace;\">masscan -sT -p0-65535 &#8211;rate 2500 &#8211;open -iL fav.out | tee tcp-open-ports.out<\/span><\/p>\n<p style=\"margin-left: 40px;\"><span style=\"font-family:Courier New,Courier,monospace;\">cat open-ports.out| wc -l<br \/>\n5091<\/span><\/p>\n<p>Goodness, that&#8217;s a list!\u00a0 For 363 hostnames, which resolved out to 373 IP addresses we found 5091 open ports!<br \/>\nIt&#8217;s possible that some of these IP&#8217;s are honeypots (never believe what the tools tell you without using your human eyeball model 1 one mark 1), but that still gives us a nice target list for further analysis!<\/p>\n<p>Stay tuned, my next post will be more recon using DNS.<\/p>\n<p>===============<br \/>\nRob VandenBrink<br \/>\nrob@coherentsecurity.com<\/p>\n<p> (c) SANS Internet Storm Center. https:\/\/isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.<\/p><\/div>\n","protected":false},"excerpt":{"rendered":"<p>I&#8217;m in the throes of target host recon for another pentest, and thought I&#8217;d share some workflow \/ automation stuff. In the past, I&#8217;ve discussed using historic DNS &#8220;mining&#8221; to collect target hosts in the domain. I thought I&#8217;d share some work on using the favicon.ico methods to expand on that.\u00a0 Jan has an excellent [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"site-container-style":"default","site-container-layout":"default","site-sidebar-layout":"default","disable-article-header":"default","disable-site-header":"default","disable-site-footer":"default","disable-content-area-spacing":"default","footnotes":""},"categories":[90],"tags":[91],"class_list":["post-3904","post","type-post","status-publish","format-standard","hentry","category-cybersecurity","tag-cybersecurity"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v26.7 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Adding some Automation to the favicon.ico method of Host Recon, (Mon, Jun 29th) - Imperative Business Ventures Limited<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/blog.ibvl.in\/index.php\/2026\/06\/29\/adding-some-automation-to-the-favicon-ico-method-of-host-recon-mon-jun-29th\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Adding some Automation to the favicon.ico method of Host Recon, (Mon, Jun 29th) - Imperative Business Ventures Limited\" \/>\n<meta property=\"og:description\" content=\"I&#8217;m in the throes of target host recon for another pentest, and thought I&#8217;d share some workflow \/ automation stuff. In the past, I&#8217;ve discussed using historic DNS &#8220;mining&#8221; to collect target hosts in the domain. I thought I&#8217;d share some work on using the favicon.ico methods to expand on that.\u00a0 Jan has an excellent [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/blog.ibvl.in\/index.php\/2026\/06\/29\/adding-some-automation-to-the-favicon-ico-method-of-host-recon-mon-jun-29th\/\" \/>\n<meta property=\"og:site_name\" content=\"Imperative Business Ventures Limited\" \/>\n<meta property=\"article:published_time\" content=\"2026-06-29T13:04:12+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/isc.sans.edu\/diaryimages\/images\/json-format-1.png\" \/>\n<meta name=\"author\" content=\"admin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"admin\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/06\/29\/adding-some-automation-to-the-favicon-ico-method-of-host-recon-mon-jun-29th\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/06\/29\/adding-some-automation-to-the-favicon-ico-method-of-host-recon-mon-jun-29th\/\"},\"author\":{\"name\":\"admin\",\"@id\":\"https:\/\/blog.ibvl.in\/#\/schema\/person\/55b87b72a56b1bbe9295fe5ef7a20b02\"},\"headline\":\"Adding some Automation to the favicon.ico method of Host Recon, (Mon, Jun 29th)\",\"datePublished\":\"2026-06-29T13:04:12+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/06\/29\/adding-some-automation-to-the-favicon-ico-method-of-host-recon-mon-jun-29th\/\"},\"wordCount\":1060,\"image\":{\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/06\/29\/adding-some-automation-to-the-favicon-ico-method-of-host-recon-mon-jun-29th\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/isc.sans.edu\/diaryimages\/images\/json-format-1.png\",\"keywords\":[\"Cybersecurity\"],\"articleSection\":[\"Cybersecurity\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/06\/29\/adding-some-automation-to-the-favicon-ico-method-of-host-recon-mon-jun-29th\/\",\"url\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/06\/29\/adding-some-automation-to-the-favicon-ico-method-of-host-recon-mon-jun-29th\/\",\"name\":\"Adding some Automation to the favicon.ico method of Host Recon, (Mon, Jun 29th) - Imperative Business Ventures Limited\",\"isPartOf\":{\"@id\":\"https:\/\/blog.ibvl.in\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/06\/29\/adding-some-automation-to-the-favicon-ico-method-of-host-recon-mon-jun-29th\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/06\/29\/adding-some-automation-to-the-favicon-ico-method-of-host-recon-mon-jun-29th\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/isc.sans.edu\/diaryimages\/images\/json-format-1.png\",\"datePublished\":\"2026-06-29T13:04:12+00:00\",\"author\":{\"@id\":\"https:\/\/blog.ibvl.in\/#\/schema\/person\/55b87b72a56b1bbe9295fe5ef7a20b02\"},\"breadcrumb\":{\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/06\/29\/adding-some-automation-to-the-favicon-ico-method-of-host-recon-mon-jun-29th\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/blog.ibvl.in\/index.php\/2026\/06\/29\/adding-some-automation-to-the-favicon-ico-method-of-host-recon-mon-jun-29th\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/06\/29\/adding-some-automation-to-the-favicon-ico-method-of-host-recon-mon-jun-29th\/#primaryimage\",\"url\":\"https:\/\/isc.sans.edu\/diaryimages\/images\/json-format-1.png\",\"contentUrl\":\"https:\/\/isc.sans.edu\/diaryimages\/images\/json-format-1.png\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/06\/29\/adding-some-automation-to-the-favicon-ico-method-of-host-recon-mon-jun-29th\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/blog.ibvl.in\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Adding some Automation to the favicon.ico method of Host Recon, (Mon, Jun 29th)\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/blog.ibvl.in\/#website\",\"url\":\"https:\/\/blog.ibvl.in\/\",\"name\":\"Imperative Business Ventures Limited\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/blog.ibvl.in\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/blog.ibvl.in\/#\/schema\/person\/55b87b72a56b1bbe9295fe5ef7a20b02\",\"name\":\"admin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/blog.ibvl.in\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/4d20b2cd313e4417a599678e950e6fb7d4dfa178a72f2b769335a08aaa615aa9?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/4d20b2cd313e4417a599678e950e6fb7d4dfa178a72f2b769335a08aaa615aa9?s=96&d=mm&r=g\",\"caption\":\"admin\"},\"sameAs\":[\"https:\/\/blog.ibvl.in\"],\"url\":\"https:\/\/blog.ibvl.in\/index.php\/author\/admin_hcbs9yw6\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Adding some Automation to the favicon.ico method of Host Recon, (Mon, Jun 29th) - Imperative Business Ventures Limited","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/blog.ibvl.in\/index.php\/2026\/06\/29\/adding-some-automation-to-the-favicon-ico-method-of-host-recon-mon-jun-29th\/","og_locale":"en_US","og_type":"article","og_title":"Adding some Automation to the favicon.ico method of Host Recon, (Mon, Jun 29th) - Imperative Business Ventures Limited","og_description":"I&#8217;m in the throes of target host recon for another pentest, and thought I&#8217;d share some workflow \/ automation stuff. In the past, I&#8217;ve discussed using historic DNS &#8220;mining&#8221; to collect target hosts in the domain. I thought I&#8217;d share some work on using the favicon.ico methods to expand on that.\u00a0 Jan has an excellent [&hellip;]","og_url":"https:\/\/blog.ibvl.in\/index.php\/2026\/06\/29\/adding-some-automation-to-the-favicon-ico-method-of-host-recon-mon-jun-29th\/","og_site_name":"Imperative Business Ventures Limited","article_published_time":"2026-06-29T13:04:12+00:00","og_image":[{"url":"https:\/\/isc.sans.edu\/diaryimages\/images\/json-format-1.png","type":"","width":"","height":""}],"author":"admin","twitter_card":"summary_large_image","twitter_misc":{"Written by":"admin","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/06\/29\/adding-some-automation-to-the-favicon-ico-method-of-host-recon-mon-jun-29th\/#article","isPartOf":{"@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/06\/29\/adding-some-automation-to-the-favicon-ico-method-of-host-recon-mon-jun-29th\/"},"author":{"name":"admin","@id":"https:\/\/blog.ibvl.in\/#\/schema\/person\/55b87b72a56b1bbe9295fe5ef7a20b02"},"headline":"Adding some Automation to the favicon.ico method of Host Recon, (Mon, Jun 29th)","datePublished":"2026-06-29T13:04:12+00:00","mainEntityOfPage":{"@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/06\/29\/adding-some-automation-to-the-favicon-ico-method-of-host-recon-mon-jun-29th\/"},"wordCount":1060,"image":{"@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/06\/29\/adding-some-automation-to-the-favicon-ico-method-of-host-recon-mon-jun-29th\/#primaryimage"},"thumbnailUrl":"https:\/\/isc.sans.edu\/diaryimages\/images\/json-format-1.png","keywords":["Cybersecurity"],"articleSection":["Cybersecurity"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/06\/29\/adding-some-automation-to-the-favicon-ico-method-of-host-recon-mon-jun-29th\/","url":"https:\/\/blog.ibvl.in\/index.php\/2026\/06\/29\/adding-some-automation-to-the-favicon-ico-method-of-host-recon-mon-jun-29th\/","name":"Adding some Automation to the favicon.ico method of Host Recon, (Mon, Jun 29th) - Imperative Business Ventures Limited","isPartOf":{"@id":"https:\/\/blog.ibvl.in\/#website"},"primaryImageOfPage":{"@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/06\/29\/adding-some-automation-to-the-favicon-ico-method-of-host-recon-mon-jun-29th\/#primaryimage"},"image":{"@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/06\/29\/adding-some-automation-to-the-favicon-ico-method-of-host-recon-mon-jun-29th\/#primaryimage"},"thumbnailUrl":"https:\/\/isc.sans.edu\/diaryimages\/images\/json-format-1.png","datePublished":"2026-06-29T13:04:12+00:00","author":{"@id":"https:\/\/blog.ibvl.in\/#\/schema\/person\/55b87b72a56b1bbe9295fe5ef7a20b02"},"breadcrumb":{"@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/06\/29\/adding-some-automation-to-the-favicon-ico-method-of-host-recon-mon-jun-29th\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/blog.ibvl.in\/index.php\/2026\/06\/29\/adding-some-automation-to-the-favicon-ico-method-of-host-recon-mon-jun-29th\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/06\/29\/adding-some-automation-to-the-favicon-ico-method-of-host-recon-mon-jun-29th\/#primaryimage","url":"https:\/\/isc.sans.edu\/diaryimages\/images\/json-format-1.png","contentUrl":"https:\/\/isc.sans.edu\/diaryimages\/images\/json-format-1.png"},{"@type":"BreadcrumbList","@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/06\/29\/adding-some-automation-to-the-favicon-ico-method-of-host-recon-mon-jun-29th\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/blog.ibvl.in\/"},{"@type":"ListItem","position":2,"name":"Adding some Automation to the favicon.ico method of Host Recon, (Mon, Jun 29th)"}]},{"@type":"WebSite","@id":"https:\/\/blog.ibvl.in\/#website","url":"https:\/\/blog.ibvl.in\/","name":"Imperative Business Ventures Limited","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/blog.ibvl.in\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/blog.ibvl.in\/#\/schema\/person\/55b87b72a56b1bbe9295fe5ef7a20b02","name":"admin","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/blog.ibvl.in\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/4d20b2cd313e4417a599678e950e6fb7d4dfa178a72f2b769335a08aaa615aa9?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/4d20b2cd313e4417a599678e950e6fb7d4dfa178a72f2b769335a08aaa615aa9?s=96&d=mm&r=g","caption":"admin"},"sameAs":["https:\/\/blog.ibvl.in"],"url":"https:\/\/blog.ibvl.in\/index.php\/author\/admin_hcbs9yw6\/"}]}},"_links":{"self":[{"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/posts\/3904","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/comments?post=3904"}],"version-history":[{"count":0,"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/posts\/3904\/revisions"}],"wp:attachment":[{"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/media?parent=3904"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/categories?post=3904"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/tags?post=3904"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}